US8438402B2 - Electronic terminal, control method, computer program and integrated circuit - Google Patents

Electronic terminal, control method, computer program and integrated circuit Download PDF

Info

Publication number
US8438402B2
US8438402B2 US12/919,313 US91931309A US8438402B2 US 8438402 B2 US8438402 B2 US 8438402B2 US 91931309 A US91931309 A US 91931309A US 8438402 B2 US8438402 B2 US 8438402B2
Authority
US
United States
Prior art keywords
protection
information
attack
defense level
value
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active, expires
Application number
US12/919,313
Other languages
English (en)
Other versions
US20110004771A1 (en
Inventor
Hideki Matsushima
Natsume Matsuzaki
Kaoru Yokota
Tomoyuki Haga
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Panasonic Corp
Original Assignee
Panasonic Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Panasonic Corp filed Critical Panasonic Corp
Assigned to PANASONIC CORPORATION reassignment PANASONIC CORPORATION ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: HAGA, TOMOYUKI, MATSUSHIMA, HIDEKI, MATSUZAKI, NATSUME, YOKOTA, KAORU
Publication of US20110004771A1 publication Critical patent/US20110004771A1/en
Application granted granted Critical
Publication of US8438402B2 publication Critical patent/US8438402B2/en
Active legal-status Critical Current
Adjusted expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6209—Protecting access to data via a platform, e.g. using keys or access control rules to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/556—Detecting local intrusion or implementing counter-measures involving covert channels, i.e. data leakage between processes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2105—Dual mode as a secondary aspect
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2151—Time stamp
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/101—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying security measures for digital rights management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection

Definitions

  • the present invention relates to technology for preventing unauthorized analysis of information (property) that is stored on an electronic terminal and should not be released to a third party.
  • Patent Document 1 discloses technology in which a server manages a pair of IDs, namely a disc ID that is unique to a disc and a device ID that is unique to a device.
  • the disc ID and the device ID are sent to the server via a network, and the server authenticates whether the use is authorized.
  • Patent Document 1 Japanese Patent Application Publication No. 2002-334511
  • the present invention aims to provide an electronic terminal, a control method, a computer program and an integrated circuit for early detection of unauthorized analysis of a device, and for preventing unauthorized acquisition and falsification of confidential information that is not to be revealed to a third party.
  • an electronic terminal that is one aspect of the present invention includes a first storage unit for storing therein confidential information to be protected; a plurality of protection measures that are provided along an attack route extending from an external source to the confidential information stored in the first storage unit, and are operable to intercept an access from the external source to the confidential information via the attack route; a plurality of monitoring units operable to monitor for an attack to any of the plurality of protection measures from the external source; a second storage unit for storing therein (i) value information that is attached to the confidential information and expresses a value of the confidential information, and (ii) a plurality of defense level information pieces each attached to one of the plurality of protection measures and expressing a defense level value of a corresponding protection measure against an attack from the external source; and a control unit operable to, when an attack to any of the plurality of protection measures has been detected, and a sum of defense level values for protection measures that have not been attacked remaining on a partial route of the attack route extending between the attacked protection
  • a protection measure that can be updated among the protection measures remaining on the partial route is updated so that the sum of the defense level values on the partial route becomes larger than the value expressed in the value information.
  • FIG. 1 shows the main structure of an unauthorized-analysis prevention system 1 ;
  • FIG. 2 shows a block diagram of the structure of the electronic terminal 102 ;
  • FIG. 3 shows the structure of model information 230 ;
  • FIG. 4 shows an exemplary data structure of a history management table T 100 ;
  • FIG. 5 is a block diagram showing the structure of the server 101 ;
  • FIG. 6 shows an exemplary data structure of a history management table T 200 ;
  • FIG. 7 is a flowchart showing operations by the electronic terminal 102 when monitoring against an attack from an external source
  • FIG. 8 is a flowchart showing operations for update processing
  • FIG. 9 is a flowchart showing operations of the server 101 ;
  • FIG. 10 shows a main structure of an unauthorized-analysis prevention system 2 ;
  • FIG. 11 is a block diagram showing the structure of the electronic terminal 1102 ;
  • FIG. 12 is a block diagram showing the structure of a server 1101 ;
  • FIG. 13 is a flowchart showing operations of update processing
  • FIG. 14 is a flowchart showing operations of the server 1101 ;
  • FIG. 15 shows the structure of model information 230 a generated by updating the model information 230 ;
  • FIG. 16 is a block diagram showing the structure of an electronic terminal 102 A
  • FIG. 17 shows the structure of the model information 230 A
  • FIG. 18 shows an exemplary data structure of a defense level table T 300 ;
  • FIG. 19 shows an exemplary data structure of a protection measure correspondence table T 400 ;
  • FIG. 20 is a block diagram showing the structure of the server 101 A
  • FIG. 21 shows the flow of operations of the electronic terminal 102 A when the defense level has been reduced
  • FIG. 22 is a flowchart showing operations of the server 101 A when the defense level of a protection measure has been reduced.
  • the electronic terminal that is one aspect of the present invention includes: a first storage unit for storing therein confidential information to be protected; a plurality of protection measures that are provided along an attack route extending from an external source to the confidential information stored in the first storage unit, and are operable to intercept an access from the external source to the confidential information via the attack route; a plurality of monitoring units operable to monitor for an attack to any of the plurality of protection measures from the external source; a second storage unit for storing therein (i) value information that is attached to the confidential information and expresses a value of the confidential information, and (ii) a plurality of defense level information pieces each attached to one of the plurality of protection measures and expressing a defense level value of a corresponding protection measure against an attack from the external source; and a control unit operable to, when an attack to any of the plurality of protection measures has been detected, and a sum of defense level values for protection measures that have not been attacked remaining on a partial route of the attack route extending between the attacked protection measure and the confidential information is
  • the electronic terminal can protect the confidential information in a new protection state in which the existing protection measures have been strengthened, since when an attack to any of the plurality of protection measures has been detected, and a sum of defense level values for protection measures remaining on the partial route is less than the value expressed by the value information, the electronic terminal updates a protection measure that can be updated among the remaining protection measures on the partial route so that the sum of the defense level values on the partial route is greater than the value expressed by the value information. This enables preventing unauthorized acquisition and falsification of the confidential information by a third party.
  • the confidential information may be encrypted by a predetermined algorithm
  • the protection measure that can be updated may be a program for executing a decryption algorithm for decrypting the encrypted confidential information
  • the electronic terminal since the electronic terminal updates the program that executes the predetermined algorithm for encrypting the confidential information so that the sum of the defense level values on the partial route is greater than the value expressed by the value information, the defense level value of the program increases, and thus the defense level of the program can be strengthened compared to the defense level of the program before the update.
  • the electronic terminal may further include: a third storage unit for storing therein a key generation program for generating a decryption key to be used in decrypting the confidential information that has been encrypted by a predetermined algorithm; a plurality of second protection measures that are provided along a second attack route extending to the confidential information stored in the first storage unit, via the key generation program stored in the third storage unit, and are operable to intercept an access from the external source to the key generation program via the second attack route; and a plurality of second monitoring units operable to monitor for an attack to any of the plurality of second protection measures from the external source.
  • a plurality of defense level information pieces may be each attached to one of the plurality of second protection measures, each expressing a defense level value of a corresponding second protection measure against an attack from the external source, and the control unit may be further operable to, when an attack to any of the second protection measures has been detected, and a sum of the defense level values for protection measures that have not been attacked remaining on a second partial route of the second attack route extending between the attacked second protection measure and the confidential information, is less than the value expressed by the value information, update the key generation program so that the sum of the defense level values on the second partial route is greater than the value expressed by the value information.
  • the electronic terminal since the electronic terminal monitors second protection measures existing on a second partial route of the second attack route from an external source to the confidential information via the key generation program, as well as monitoring the protection measures existing on the attack route from the external source to the confidential information, monitoring can be performed more reliably against an attack from a third party. Also, when the total of the defense level values on the second partial route is less than the value of the confidential information, since the electronic terminal updates the key generation program so that the total of the defense level values on the second partial route is greater than the value expressed by the confidential information, this structure also enables strengthening defenses against an attack to the second partial route.
  • the electronic terminal may further include: a third storage unit for storing therein a decryption key to be used in decrypting the confidential information that has been encrypted by a predetermined algorithm; a fourth storage unit for storing therein a predetermined program for accessing the decryption key; a plurality of second protection measures that are provided along a second attack route extending to the confidential information stored in the first storage unit, via the predetermined program stored in the fourth storage unit, and are operable to intercept an access from the external source to the predetermined program via the second attack route; and a plurality of second monitoring units operable to monitor for an attack to any of the plurality of second protection measures from the external source.
  • a third storage unit for storing therein a decryption key to be used in decrypting the confidential information that has been encrypted by a predetermined algorithm
  • a fourth storage unit for storing therein a predetermined program for accessing the decryption key
  • a plurality of second protection measures that are provided along a second attack route extending to the
  • a plurality of defense level information pieces are each attached to one of the plurality of second protection measures, each expressing a defense level value of a corresponding second protection measure against an attack from the external source, and the control unit is further operable to, when an attack to any of the second protection measures has been detected, and a sum of the defense level values for protection measures that have not been attacked remaining on a second partial route of the second attack route extending between the attacked second protection measure and the confidential information, is less than the value expressed by the value information, update the predetermined program so that the sum of the defense level values on the second partial route is greater than the value expressed by the value information.
  • the predetermined program for accessing the decryption key may be a decryption program for decrypting the encrypted decryption key when the decryption key has been encrypted.
  • the electronic terminal can strengthen defenses against an attack to the decryption key by updating the decryption program.
  • the decryption program may have been obfuscated.
  • the electronic terminal can strengthen defenses against an attack to the decryption key by updating the obfuscated decryption program.
  • the electronic terminal may further include a third storage unit for storing therein a protection measure to be used for performing an update.
  • the control unit may update the protection measure that can be updated with use of the protection measure to be used for performing the update, that is stored in the third storage unit.
  • the electronic terminal can update a protection measure that can be updated upon detecting an attack from an external source, without requiring another device.
  • the electronic terminal may further include a communication unit connected to an external management device that manages the electronic terminal.
  • the control unit may be further operable to, when an attack to any of the plurality of protection measures has been detected, and a sum of the defense level values for protection measures remaining on the partial route is less than the value expressed by the value information, transmit detection information indicating the detection and the comparison to the management device via the communication unit, receive a new protection measure from the management device, in accordance with the detection information, such that the sum of the defense level values for the protection measures remaining on the partial route is greater than the value expressed by the value information, and update the protection measure that can be updated to the new protection measure.
  • the electronic terminal may further include a communication unit connected to an external management device that manages the electronic terminal.
  • the control unit may be further operable to, when an attack to any of the plurality of protection measures has been detected, and a sum of the defense level values for remaining protection measures on the partial route is less than the value expressed by the value information, transmit detection information indicating the detection and the comparison to the management device via the communication unit, receive a new protection measure from the management device, in accordance with the detection information, such that the sum of the defense level values for the protection measures remaining on the partial route is greater than the value expressed by the value information, and add the new protection measure to the partial route.
  • the electronic terminal since the electronic terminal receives, from the external management device, a new protection measure for updating or being added, it is not necessary for the electronic terminal to include storage capacity for internally storing a new protection measure in advance.
  • a new protection measure that is stored in advance would also require use of some protection mechanism to protect from an attack by a third party.
  • the present structure enables reducing manufacturing cost over a case of storing a new protection measure internally in advance.
  • the electronic terminal may further include: a communication unit connected to an external management device that manages the electronic terminal; and a third storage unit for storing therein a plurality of second defense level information pieces received from the management device, each expressing an updated value of a defense level value of a corresponding protection measure.
  • the control unit may be further operable to (i) compare each piece of defense level information stored in the second storage unit to a piece of corresponding defense level information stored in the third storage unit, (ii) when a result of the comparison is that the defense level value expressed by the defense level information is less than the defense level value expressed by the second defense level information, calculate a sum of defense levels for the plurality of protection measures with reference to the second defense level information, and (iii) when the calculated sum is less than the value expressed by the value information, update a protection measure corresponding to the second defense level information that is less than the defense level information so that the total of the defense level values on the attack route is greater than the value expressed by the value information.
  • the electronic terminal updates the protection measure so that the defense level value of the attack route is higher than the value expressed by the confidential information. Therefore, the defense of the attack route is strengthened over the defense of the attack route before the update.
  • another aspect of the present invention is a control method for an electronic terminal, the electronic terminal including: a first storage unit for storing therein confidential information to be protected; a plurality of protection measures that are provided along an attack route extending from an external source to the confidential information stored in the first storage unit, and are operable to intercept an access from the external source to the confidential information via the attack route; a plurality of monitoring units operable to monitor for an attack to any of the plurality of protection measures from the external source; and a second storage unit for storing therein (i) value information that is attached to the confidential information and expresses a value of the confidential information, and (ii) a plurality of defense level information pieces each attached to one of the plurality of protection measures and expressing a defense level value of a corresponding protection measure against an attack from the external source.
  • the computer program causes a computer of the electronic terminal to perform the processing of: judging, when an attack to any of the plurality of protection measures has been detected, whether a sum of defense level values for protection measures that have not been attacked remaining on a partial route of the attack route extending between the attacked protection measure and the confidential information is less than the value expressed by the value information, and if the sum is less than the value, updating a protection measure that can be updated among the remaining protection measures on the partial route so that the sum of the defense level values on the partial route is greater than the value expressed by the value information.
  • the electronic terminal can protect the confidential information in a new protection state in which the existing protection measures have been strengthened, since when an attack to any of the plurality of protection measures has been detected, and a sum of defense level values for protection measures that have not been attacked remaining on a partial route of the attack route extending between the attacked protection measure and the confidential information is less than the value expressed by the value information, the electronic terminal updates a protection measure that can be updated among the remaining protection measures on the partial route so that the sum of the defense level values on the partial route is greater than the value expressed by the value information. This enables preventing unauthorized acquisition and falsification of the confidential information by a third party.
  • another aspect of the present invention is an integrated circuit used in an electronic terminal, the electronic terminal including: a first storage unit for storing therein confidential information to be protected; a plurality of protection measures that are provided along an attack route extending from an external source to the confidential information stored in the first storage unit, and are operable to intercept an access from the external source to the confidential information via the attack route; a plurality of monitoring units operable to monitor for an attack to any of the plurality of protection measures from the external source; a second storage unit for storing therein (i) value information that is attached to the confidential information and expresses a value of the confidential information, and (ii) a plurality of defense level information pieces each attached to one of the plurality of protection measures and expressing a defense level value of a corresponding protection measure against an attack from the external source; and a control unit operable to, when an attack to any of the plurality of protection measures has been detected, and a sum of defense level values for protection measures that have not been attacked remaining on a partial route of the attack route extending between
  • the integrated circuit can protect the confidential information in a new protection state in which the existing protection measures have been strengthened, since when an attack to any of the plurality of protection measures has been detected, and a sum of defense level values for protection measures that have not been attacked remaining on a partial route of the attack route extending between the attacked protection measure and the confidential information is less than the value expressed by the value information, the integrated circuit updates a protection measure that can be updated among the remaining protection measures on the partial route so that the sum of the defense level values on the partial route is greater than the value expressed by the value information. This enables preventing unauthorized acquisition and falsification of the confidential information by a third party.
  • the management device that is one aspect of the present invention includes: a communication unit and a control unit.
  • the control unit is connected to an electronic terminal that stores confidential information to be protected, stores a plurality of protection measures that are provided along an attack route extending from an external source to the stored confidential information and are operable to intercept an access from the external source to the confidential information via the attack route, and monitors for an attack to any of the plurality of protection measures from the external source.
  • the control unit of the management device Upon receiving, from the electronic terminal, (i) value information expressing a value of the confidential information attached to the confidential information, (ii) a plurality of defense level information pieces each expressing a defense level value of a corresponding protection measure against an attack from the external source attached to each protection measure, and (iii) detection information indicating that an attack to any of the protection measures has been detected, the control unit of the management device is operable to judge whether a sum of defense level values for protection measures that have not been attacked remaining on a partial route of the attack route extending between the attacked protection measure and the confidential information is less than the value expressed by the value information, and when the judgment is affirmative, to update a protection measure that can be updated among the remaining protection measures on the partial route, so that the sum of the defense level values on the partial route is greater than the value expressed by the value information.
  • the control unit is further operable to transmit a protection measure for updating to the electronic terminal.
  • the electronic terminal upon receiving the protection measure for updating from the management device, updates the protection
  • the management device transmits, to the electronic terminal, a protection measure for updating so that the sum of the defense level values on the partial route becomes greater than the value expressed by the value information.
  • the management device that is one aspect of the present invention includes: a communication unit and a control unit.
  • the communication unit is connected to an electronic terminal that stores confidential information to be protected, stores a plurality of protection measures that are provided along an attack route extending from an external source to the stored confidential information and are operable to intercept an access from the external source to the confidential information via the attack route, and monitors for an attack to any of the plurality of protection measures from the external source.
  • the control unit of the management device Upon receiving, from the electronic terminal, (i) value information expressing a value of the confidential information attached to the confidential information, (ii) a plurality of defense level information pieces each expressing a defense level value of a corresponding protection measure against an attack from the external source attached to each protection measure, and (iii) detection information, the control unit of the management device is operable to judge whether a sum of defense level values for protection measures that have not been attacked remaining on a partial route of the attack route extending between the attacked protection measure and the confidential information is less than the value expressed by the value information, and when the judgment is affirmative, to perform control to transmit, to the electronic terminal, a new protection measure such that the sum of the defense level values on the partial route is greater than the value expressed by the value information.
  • the electronic terminal upon receiving the new protection measure from the management device, adds the new protection measure to the partial route.
  • the management device transmits, to the electronic terminal, a new protection measure such that the sum of the defense level values on the partial route becomes greater than the value expressed by the value information.
  • the management device is connected to an electronic terminal that stores confidential information to be protected, stores a plurality of protection measures that are provided along an attack route extending from an external source to the stored confidential information and are operable to intercept an access from the external source to the confidential information via the attack route, and monitors for an attack to any of the plurality of protection measures from the external source.
  • the control method includes control for the management device to receive, from the electronic terminal, value information expressing a value of the confidential information attached to the confidential information, a plurality of defense level information pieces each expressing a defense level value of a corresponding protection measure against an attack from the external source attached to each protection measure, and detection information indicating that an attack to any of the protection measures has been detected.
  • the management device Upon receiving the value information, the plurality of defense level information pieces, and the detection information from the electronic terminal, the management device performs control to judge whether a sum of defense level values for protection measures that have not been attacked remaining on a partial route of the attack route extending between the attacked protection measure and the confidential information is less than the value expressed by the value information, and when the judgment is affirmative, to perform control to transmit, to the electronic terminal, a new protection measure such that the sum of the defense level values on the partial route is greater than the value expressed by the value information.
  • the electronic terminal upon receiving the new protection measure from the management device, updates the protection measure that can be updated with the protection measure for updating.
  • a computer program that is one aspect of the present invention performs control on a management device connected to an electronic terminal that stores confidential information to be protected, stores a plurality of protection measures that are provided along an attack route extending from an external source to the stored confidential information and are operable to intercept an access from the external source to the confidential information via the attack route, and monitors for an attack to any of the plurality of protection measures from the external source.
  • the computer program causes a computer of the management device to receive, from the electronic terminal, value information expressing a value of the confidential information attached to the confidential information, a plurality of defense level information pieces each expressing a defense level value of a corresponding protection measure against an attack from the external source attached to each protection measure, and detection information indicating that an attack to any of the protection measures has been detected.
  • the computer program Upon receiving the value information, the defense level information pieces, and the detection information, the computer program causes the computer of the management device to judge whether a sum of defense level values for protection measures that have not been attacked remaining on a partial route of the attack route extending between the attacked protection measure and the confidential information is less than the value expressed by the value information, and when the judgment is affirmative, to perform control to cause the computer to transmit, to the electronic terminal, a new protection measure such that the sum of the defense level values on the partial route is greater than the value expressed by the value information.
  • the electronic terminal upon receiving the new protection measure from the management device, updates the protection measure that can be updated with the new protection measure for updating.
  • the electronic terminal can protect the confidential information in a new protection state in which the existing protection measures have been strengthened, since when an attack to any of the plurality of protection measures has been detected, and a sum of defense level values for protection measures that have not been attacked remaining on a partial route of the attack route extending between the attacked protection measure and the confidential information is less than the value expressed by the value information, the electronic terminal updates a protection measure that can be updated among the remaining protection measures on the partial route so that the sum of the defense level values on the partial route is greater than the value expressed by the value information. This enables preventing unauthorized acquisition and falsification of the confidential information by a third party.
  • an integrated circuit that is one aspect of the present invention is used in a management device that is connected to an electronic terminal that stores confidential information to be protected, stores a plurality of protection measures that are provided along an attack route extending from an external source to the stored confidential information and are operable to intercept an access from the external source to the confidential information via the attack route, and monitors for an attack to any of the plurality of protection measures from the external source.
  • the management device performs control to receive, from the electronic terminal, value information expressing a value of the confidential information attached to the confidential information, a plurality of defense level information pieces each expressing a defense level value of a corresponding protection measure against an attack from the external source attached to each protection measure, and detection information indicating that an attack to any of the protection measures has been detected.
  • FIG. 1 shows the main structure of the unauthorized-analysis prevention system 1 pertaining to Embodiment 1 of the present invention.
  • the unauthorized-analysis prevention system 1 includes a server 101 and electronic terminals 102 a , . . . , 102 b , and the server 101 performs communication with the electronic terminals 102 a , . . . , 102 b via a network 103 .
  • an electronic terminal 102 As an exemplary one of the electronic terminals 102 a , . . . , 102 b.
  • the electronic terminal 102 is a computer system constituted from the constituent elements of a CPU, a RAM, a data reading device (drive device), and a network connection interface.
  • the electronic terminal 102 stores therein property that is not to be released to a third party, and manages the property using a plurality of protection measures for protecting the property from unauthorized analysis by a third party.
  • the protection measures may include encryption of the property, code obfuscation, concealment of a debugger terminal, disabling the debugger, etc.
  • a debugger terminal is used when operational tests, etc. are performed on the electronic terminal 102 prior to shipping, and is used when connecting a device that performs debugging (debugger device) to the electronic terminal 102 .
  • the debugger terminal performs authentication.
  • the debugger terminal may be located on a circuit board, and be concealed at the time of shipping in order to prevent users from using the debugger terminal after shipping.
  • the electronic terminal 102 judges whether to add a new protection measure, and if the judgment is affirmative, transmits update request information indicating this judgment to the server 101 .
  • the server 101 Upon receiving the detection information from the electronic terminal 102 , the server 101 stores the received detection information.
  • the server 101 upon receiving the update request information from the electronic terminal 102 , the server 101 responds to the request by transmitting a protection measure (specifically a program, etc.) to the electronic terminal 102 .
  • a protection measure specifically a program, etc.
  • the following describes the structure of the electronic terminal 102 .
  • the electronic terminal 102 includes a detection information generation unit 201 , a signature attachment unit 202 , a date and time information acquisition unit 203 , a storage destination selection unit 204 , a history management unit 205 , a model storage unit 206 , a defense level calculation unit 207 , an update requirement judgment unit 208 , an update location determination unit 209 , an update request generation unit 210 , monitoring units 211 a , 211 b , . . . , 211 n , a protection method reception unit 212 , a protection method update unit 213 , a transmission unit 214 , an identifier storage unit 215 , and a secure information storage unit 216 .
  • the secure information storage unit 216 is a secure storage that can safely preserve information therein.
  • the secure information storage unit 216 stores property that is not to be released to a third party so that the property is protected by one or more protection measures.
  • FIG. 3 shows the model information 230 in a case of preventing an attack from an unauthorized external source by using an encryption protection measure (hereinafter referred to as encryption) 232 on the protected property 250 .
  • the encryption protection measure is a decryption program for decrypting the encryption applied to the property 250 .
  • the encrypted property 250 can be attacked according to either of the following two attack patterns.
  • the first attack pattern includes methods such as the “brute force method” of trying all possible candidates of keys, the “linear cryptanalysis” method of predicting keys, etc.
  • a protection measure involving code obfuscation of the key 251 (hereinafter referred to simply as code obfuscation) 243 is used as a protection measure against the second attack pattern.
  • code obfuscation code obfuscation
  • a protection measure involving disabling debugging to prevent analysis of a code (key) that has been obfuscated (hereinafter referred to simply as debugger disabling) 242 is used.
  • the debugger disabling 242 is a program that, for example, disables interrupt processing due to debugging.
  • the key 251 corresponds to the associated property described above.
  • the code obfuscation of the key 251 in the present embodiment refers to obfuscating a program for accessing the key 251 (for example, a decryption program for decrypting encrypted property with use of the key 251 ).
  • each protection measure has a corresponding defense level, and also has a corresponding protection identifier “Point x-y” for identifying the position on the protection path where the protection measure is located.
  • the defense level is “10”
  • the protection identifier is “Point 1-2”.
  • protection identifiers are also used in the model information 230 to identify each of the protection measures.
  • the defense level is a marker indicating, for example, how much expense is required for analyzing a certain protection measure, the expense of the tools required, or the cost of employing an engineer to attack the protection measure.
  • the property 250 to be protected by the terminal 102 has a corresponding value (a property value, that is “10” in this case).
  • the property value is calculated based on an amount of loss anticipated if the property is stolen, for example. This value is considered a marker by a similar rule as the defense level. When this value is expressed in a form that can be compared with the defense level, the result is the property value.
  • the electronic terminal 102 stores, in the secure information storage unit 216 , secure information constituted from a property 250 protected by the encryption 232 , and the key 251 protected by the code obfuscation 243 .
  • a monitoring unit 211 as an exemplary one of the monitoring units 211 a , 211 b . . . , 211 n.
  • the monitoring unit 211 is for monitoring a targeted protection measure, and is stored in a predetermined storage area in the electronic terminal 102 .
  • the monitoring unit 211 pre-stores a protection identifier “Point x-y” for the targeted protection measure.
  • the monitoring unit 211 monitors whether the targeted protection measure has been attacked by an external source.
  • the monitoring unit 211 monitors whether the programs of the monitored protection measures or the data thereof have been falsified. For example, the monitoring unit 211 pre-stores hash values corresponding to the targeted programs and the data thereof (for example, an encrypted property, an obfuscated key generation program or an obfuscated debugger-disabling program), periodically calculating hash values of monitored programs and data, and checking whether the calculated hash values match the stored hash values.
  • the history management unit 205 includes a history management table T 100 for recording information generated when the monitoring unit 211 detects an unauthorized attack, the information conveying facts about the attack.
  • the history management table T 100 includes areas for storing at least one information set each composed of a transmission flag, a date and time, and a protection identifier.
  • the transmission flag is information indicating whether information conveying facts about the attack has already been transmitted to the server 101 .
  • a value “0” indicates that the information has not yet been transmitted, and a value “1” indicates that the information has been transmitted.
  • the date and time is the date and time at which the monitoring unit 211 detected an attack.
  • the protection identifier is an identifier of the protection measure to be monitored by the monitoring unit 211 .
  • the detection information generation unit 201 Upon receiving a notification that an attack has occurred from the monitoring unit 211 , the detection information generation unit 201 outputs a date and time acquisition instruction to the date and time information acquisition unit 203 in order to acquire the present date and time.
  • the detection information generation unit 201 Upon receiving date and time information indicating the present date and time from the date and time information acquisition unit 203 , the detection information generation unit 201 generates detection information including the date and time information and the protection identifier of the monitored protection measure.
  • the detection information generation unit 201 transmits, to the storage destination selection unit 204 , a transmission judgment instruction to perform a judgment as to whether the generated detection information can be transmitted to the server 101 .
  • the detection information generation unit 201 Upon receiving transmission incapability information from the storage destination selection unit 204 indicating that transmission to the server 101 is impossible, the detection information generation unit 201 sets the transmission flag to the value “0”. The detection information generation unit 201 stores the generated detection information in correspondence with the transmission flag that has been set to the value “0” in the history management unit 205 .
  • the detection information generation unit 201 Upon receiving transmission capability information indicating that transmission to the server 101 is possible, the detection information generation unit 201 acquires all of the detection information that is stored in the history management unit 205 and has not been transmitted to the server 101 (untransmitted detection information). Specifically, the detection information generation unit 201 acquires all of the detection information for which the value of the transmission flag is “0”.
  • the detection information generation unit 201 outputs the generated detection information and the untransmitted detection information to the signature attachment unit 202 so that signature data can be attached to the generated detection information and all of the acquired untransmitted detection information. Upon receiving back the detection information and the untransmitted detection information with the signature data attached thereto, the detection information generation unit 201 acquires the management ID from the identifier storage unit 215 .
  • the detection information generation unit 201 transmits the detection information and the untransmitted detection information, with the attached signature data, and the management ID to the server 101 via the transmission unit 214 .
  • the detection information generation unit 201 changes the value of the transmission flag of the untransmitted detection information stored in the history management unit 205 from “0” to “1”.
  • the detection information generation unit 201 outputs only the generated detection information to the signature attachment unit 202 .
  • the detection information generation unit 201 receives only the detection information having attached signature data from the signature attachment unit 202 , and transmits only the received detection information having the attached signature data to the server 101 .
  • the detection information generation unit 201 acquires all of the protection identifiers included in the transmitted detection information and the untransmitted detection information.
  • the detection information generation unit 201 outputs all of the acquired protection identifiers and update requirement judgment instructions to the update requirement judgment unit 208 .
  • the signature attachment unit 202 attaches, to the detection information, signature data for certifying that the detection information was generated by the electronic terminal 102 . It can be seen by verifying this signature data that the detection information was generated by the electronic terminal 102 . Note that hereinafter, checking whether the detection information was generated by the electronic terminal 102 is referred to as checking the authenticity of the detection information, or checking the authenticity of the transmission source of the detection information.
  • the following describes the specific operations of the signature attachment unit 202 .
  • the signature attachment unit 202 pre-stores a secret key (SK) used for generating the signature data.
  • SK secret key
  • the signature attachment unit 202 Upon receiving one or more piece of detection information from the detection information generation unit 201 , the signature attachment unit 202 generates signature data for all of the received detection information using the secret key (SK). Since known digital signature technology may be used for generating the signature data, a detailed description of the generation procedure is omitted.
  • the signature attachment unit 202 attaches the generated signature data to the detection information targeted for signature, and outputs, to the detection information generation unit 201 , the detection information with the signature data attached.
  • the server 101 can check the authenticity of the transmission source of the detection information.
  • the date and time information acquisition unit 203 includes a clock function that outputs the date and time.
  • the date and time information acquisition unit 203 Upon receiving the date and time acquisition instruction from the detection information generation unit 201 , the date and time information acquisition unit 203 acquires date and time information indicating the current time with the clock function, and outputs the acquired date and time information to the detection information generation unit 201 .
  • date and time information it is preferable for the date and time information to be implemented in such a way that unauthorized analysis is impossible.
  • the storage destination selection unit 204 selects whether to transmit the detection information to the server 101 to be stored, or to store the detection information in the history management unit 205 , and notifies the result of the selection to the detection information generation unit 201 .
  • the following describes the specific operations of the storage destination selection unit 204 .
  • the storage destination selection unit 204 judges whether there is a network connection.
  • the storage destination selection unit 204 When a judgment is made that there is not a network connection, that is, when it is judged that transmission cannot be performed with the server 101 , the storage destination selection unit 204 outputs the transmission incapability information to the detection information generation unit 201 .
  • the storage destination selection unit 204 When a judgment is made that there is a network connection, that is, when it is judged that transmission can be performed with the server 101 , the storage destination selection unit 204 outputs the transmission capability information to the detection information generation unit 201 .
  • the update requirement judgment unit 208 Upon receiving an update requirement judgment instruction and one or more protection identifiers from the detection information generation unit 201 , the update requirement judgment unit 208 outputs, to the defense level calculation unit 207 , each of the received protection identifiers and a calculation instruction instructing calculation of a defense level.
  • the update requirement judgment unit 208 Upon receiving one or more defense levels calculated by the defense level calculation unit 207 , the update requirement judgment unit 208 acquires a value of the protected property 250 from the model information 230 recorded in the model storage unit 206 . The update requirement judgment unit 208 compares each of the acquired values with each of the received defense levels. Note that each of the defense levels calculated by the defense level calculation unit 207 indicate a defense level of a path to the respective property passed by someone attempting unauthorized analysis. The details thereof are described later.
  • the update requirement judgment unit 208 judges that an update is required.
  • the update requirement judgment unit 208 outputs, to the update location determination unit 209 , an update location determination instruction instructing the determination of an update location, and one or more protection identifiers received from the detection information generation unit 201 .
  • the defense level calculation unit 207 receives a calculation instruction and one or more protection identifiers from the update requirement judgment unit 208 .
  • the defense level calculation unit 207 acquires, from among the protection paths that could be passed by someone attempting to reach the protected property, all protection paths including one or more protection measures that corresponds to the one or more received protection identifiers.
  • the defense level calculation unit 207 calculates a defense level pertaining to the strength of security for all of the acquired protection paths, excluding any protection measure to which an attack has been detected.
  • the defense level calculation unit 207 outputs the calculated defense level of each of the acquired protection paths to the update requirement judgment unit 208 .
  • the defense level of a protection path in this context can be expressed as the sum of all of the defense levels for each of the protection measures on the protection path.
  • the defense level of the protection path when there are three protection measures in the protection path is calculated as follows.
  • Defense Level of Protection Path Defense Level of First Protection Measure+Defense Level of Second Protection Measure+Defense Level of Third Protection Measure
  • the defense levels of the first protection path 260 and the second protection path 261 are, respectively, “20” (the sum of the defense level “10” of the debugger terminal concealment 231 and the defense level “10” of the encryption 232 ), and “17” (the sum of the defense level “10” of the debugger terminal concealment 241 , the defense level “5” of the debugger disabling 242 , and the defense level “2” of the code obfuscation 243 ).
  • the defense level calculation unit 207 can determine that the protection measure identified by the protection identifier “Point 2-1” has been attacked. For this reason, the defense level calculation unit 207 calculates the defense level “7”, as the defense level of the second protection path 261 after the attack is detected, by calculating the sum of the other protection measures besides the debugger terminal concealment 241 that corresponds to the protection identifier “Point 2-1” in the second protection path 261 .
  • the update location determination unit 209 determines, based on a security implementation model of the security state after the attack, one or more locations requiring an update (hereinafter referred to as update locations), and a defense level required for each update location.
  • the update location determination unit 209 outputs the one or more determined update locations and the defense level required for each update location to the update request generation unit 210 .
  • the update location determination unit 209 selects an effective location for defense against an attack from an external source, either by adding a new protection measure, or updating (strengthening the defense level of) an existing protection measure.
  • a location is selected that is closer to the protected property than the attacked location (location where the attack was detected) is. That is to say, an effective location is selected on the portion of the path from the location where the attack was detected to the protected property. The reason for this is that if a new protection measure is added over the protection measure that has already been broken, the attacker is likely to bypass the new protection measure and perform a direct attack from the broken protection measure.
  • a plurality of locations may be selected as update locations.
  • updating the existing protection measure means, for example, if the existing protection measure is an encryption program, changing the encryption program to a stronger encryption program.
  • the update location determination unit 209 determines (calculates) a defense level for the new protection measure so that the defense level of the protection path to include the new protection measure is greater than the property value.
  • the update location determination is realized by, for example, specifying a protection identifier of one or more protection measures adjacent to the update location. For example, when one protection identifier is specified, the location to be updated is between the protection measure corresponding to the one specified protection identifier and the protected property, for example. Also, when two protection identifiers are specified, the location to be updated is between the two protection measures corresponding respectively to the two specified protection identifiers.
  • the update request generation unit 210 Upon receiving one or more determined update locations and a defense level required for each location from the update location determination unit 209 , the update request generation unit 210 acquires a management ID from the identifier storage unit 215 .
  • the update request generation unit 210 generates update request information constituted from the acquired management ID, the received one or more update locations, and the one or more defense levels corresponding to the one or more update locations, and transmits the generated update request information to the server 101 via the transmission unit 214 .
  • the transmission unit 214 Upon receiving the detection information and untransmitted detection information with attached signature data and the management ID from the detection information generation unit 201 , the transmission unit 214 transmits the received detection information and the untransmitted detection information with signature data attached and the management ID to the server 101 via the network 103 .
  • the transmission unit 214 Upon receiving the update request information from the update request generation unit 210 , the transmission unit 214 transmits the update request information to the server 101 via the network 103 .
  • the protection method reception unit 212 receives one or more protection measures determined based on the transmitted update request information, and a new monitoring unit corresponding to each of the one or more protection measures, from the server 101 via the network 103 .
  • the protection method reception unit 212 receives new secure information pertaining to a new protection measure applied to the protected property 250 or the key 251 , new model information indicating the secure information, and one or more new monitoring units, from the server 101 .
  • the new secure information pertaining to the new applied protection measure is either secure information pertaining to a newly added protection measure, or secure information pertaining to a new protection measure that replaces an existing protection measure and that has a stronger defense level than the existing protection measure.
  • a case of a newly added protection measure occurs when, for example, encryption is added as the new protection measure between the code obfuscation 243 and the debugger disabling 242 on the second protection path 261 .
  • a case of replacing an existing protection measure with a new protection measure that has a stronger defense level than the existing protection measure occurs when, for example, the encryption 232 (defense level 10) of the first protection path 260 is replaced with an encryption having a higher defense level than 10 (for example, defense level 12) as a new protection measure.
  • information included in the secure information may include a key, or a program for decryption processing, that is associated information for decrypting the encryption.
  • the protection method update unit 213 replaces, that is to say updates, secure information currently stored in a secure storage (the secure information storage unit 216 ) with new secure information received by the protection method reception unit 212 .
  • the protection method update unit 213 replaces, that is to say updates, model information 230 stored in the current model storage unit 206 with the new model information received by the protection method reception unit 212 .
  • the protection method update unit 213 stores the received one or more monitoring units in a predetermined storage area in the electronic terminal 102 .
  • the program is stored in the predetermined area.
  • the following describes the structure of the server 101 .
  • the server 101 includes a reception unit 302 , a history management unit 304 , a protection method selection unit 306 , a protection method storage unit 308 , a protection method delivery unit 310 , and a detection information reception unit 312 .
  • the reception unit 302 Upon receiving one or more pieces of detection information with attached signature information and the management ID from the electronic terminal 102 via the network 103 , the reception unit 302 outputs the received one or more pieces of detection information with attached signature information and the management ID to the detection information reception unit 312 .
  • the reception unit 302 Upon receiving the update request information from the electronic terminal 102 via the network 103 , the reception unit 302 outputs the received update request information to the protection method selection unit 306 .
  • a public key (PK) corresponding to the secret key (SK) stored in the electronic terminal 102 is correlated to the management ID of the electronic terminal 102 , and stored in advance.
  • the detection information reception unit 312 Upon receiving the one or more detection information pieces with signature data attached and the management ID from the reception unit 302 , the detection information reception unit 312 acquires a public key (PK) corresponding to the received management ID.
  • PK public key
  • the detection information reception unit 312 verifies the signature data corresponding to the one or more received detection information pieces with use of the acquired public key. Note that since signature verification is known technology, description thereof is omitted here.
  • the detection information reception unit 312 stores the received one or more detection information pieces in correspondence with the received management ID in the history management unit 304 .
  • the history management unit 304 includes a history management table T 200 having recorded therein detection information transmitted from the electronic terminal 102 .
  • the history management table T 200 includes an area for storing at least one set constituted from a management ID, a date and time, and a protection identifier.
  • the management ID is a management ID for identifying the electronic terminal 102 that transmitted the detection information.
  • the date and time is the date and time at which the electronic terminal 102 corresponding to the management ID detected an attack.
  • the protection identifier is an identifier of the protection measure to which the attack has been detected.
  • the protection method storage unit 308 stores protection methods that can be used in the electronic terminal 102 .
  • the protection method storage unit 308 stores a plurality of types of model information, each having a different protection pattern by which the electronic terminal 102 protects the protected property 250 .
  • each piece of model information includes a model identifier for identifying the model information piece, and a secure information piece protected by the model indicated by the model information, in correspondence with each other.
  • the model information stored in the protection method storage unit 308 includes the model information 230 shown in FIG. 3 , model information pertaining to an encryption that protects the property 250 and is different from the encryption 232 indicated by the model information 230 , model information pertaining to a protection measure existing between the code obfuscation 243 and the debugger disabling 242 indicated by the model information 230 , etc.
  • the protection method storage unit 308 stores a corresponding monitoring unit for monitoring the protection measure.
  • the protection method selection unit 306 selects a protection method and one or more monitoring units appropriate for transmitting from the protection method storage unit 308 to the electronic terminal 102 , the selection being based on the one or more locations requiring an update and the defense level required for each update location included in the received update request information.
  • the protection method selection unit 306 stores the model identifiers corresponding to the model information stored in the electronic terminal 102 , in correspondence with the management ID of the electronic terminal 102 , in a secure storage area.
  • the protection method selection unit 306 Upon receiving the update request information from the reception unit 302 , the protection method selection unit 306 acquires the management ID included in the received update request information, and acquires a model identifier corresponding to the acquired management ID from the secure memory area.
  • the protection method selection unit 306 acquires model information corresponding to the acquired model identifier from the protection method storage unit 308 . Based on the acquired model information, the one or more locations requiring an update included in the received update request information, and the defense level required for each of the locations requiring an update, the protection method selection unit 306 acquires the new model information, in addition to a new model identifier and new security information corresponding to the new model information, from the protection method storage unit 308 .
  • the new secure information acquired at this time is either secure information pertaining to a new protection measure added at the update location, or secure information pertaining to a new protection measure that replaces an existing protection measure located at the update location, and that has a stronger defense level than the existing, protection measure.
  • the protection measure selection unit 306 acquires one or more new monitoring units corresponding respectively to the one or more new protection measures included in the new acquired secure information.
  • the protection method selection unit 306 transmits the acquired new model information, the new secure information, and the one or more monitoring units to the electronic terminal 102 pertaining to the update request, via the protection method delivery unit 310 .
  • the protection method selection unit 306 replaces, that is to say updates, the model identifier corresponding to the management ID of the electronic terminal 102 that is the transmission destination currently stored in the secure storage unit with the model identifier corresponding to the acquired new model information.
  • the update is performed in such a manner that there can be no roll-back, that is return, to previous secure information. Specifically, this is realized by such a method as version management.
  • the protection method delivery unit 310 Upon receiving new model information and new secure information from the protection method selection unit 306 , the protection method delivery unit 310 transmits the received new model information and the new secure information to the electronic terminal 102 pertaining to the update request, via the network 103 .
  • the new protection measure is encryption
  • a program for decryption processing is included in the secure information that is sent.
  • the following describes operations of the electronic terminal 102 while monitoring for an attack from an external source, with reference to the flowchart shown in FIG. 7 .
  • the electronic terminal 102 monitors whether the protection measure being monitored has been attacked by an external source (step S 5 ).
  • step S 5 When a judgment is made that an attack has occurred (“YES” in step S 5 ), the electronic terminal 102 , with use of the date and time information acquisition unit 203 , acquires date and time information indicating the current date and time (step S 10 ).
  • the electronic terminal 102 with use of the detection information generation unit 201 , generates detection information including the acquired date and time information and the protection identifier corresponding to the protection method that has been attacked (step S 15 ).
  • the electronic terminal 102 judges whether the generated detection information can be transmitted to the server 101 (step S 20 ). Specifically, the electronic terminal 102 , with use of the storage destination selection unit 204 , judges whether there is a network connection.
  • the electronic terminal 102 When transmission is judged to be possible (“YES” in step S 20 ), the electronic terminal 102 , with use of the signature attachment unit 202 , attaches signature data to the generated detection information (step S 25 ).
  • the electronic terminal 102 with use of the detection information generation unit 201 , transmits the detection information with attached signature data and the management ID to the server 101 (step S 30 ).
  • the signature attachment unit 202 attaches the signature data to the generated detection information and all of the untransmitted detection information.
  • the detection information generation unit 201 transmits all of the detection information and the untransmitted detection information with the signature data attached, along with the management ID, to the server 101 . Note that when no untransmitted detection information exists, the signature attachment unit 202 attaches signature data to the generated detection information only, and the detection information generation unit 201 transmits the detection information with the signature data attached and the management ID to the server 101 .
  • the electronic terminal 102 Upon transmitting the detection information to the server 101 , the electronic terminal 102 judges whether an update is required, using update processing described later. If an update is judged to be required, the electronic terminal 102 receives new secure information from the server 101 , and updates the secure information currently stored with new secure information (step S 35 ).
  • step S 20 When transmission is judged to be impossible (“NO” in step S 20 ), the electronic terminal 102 , with use of the detection information generation unit 201 , sets the transmission flag to the value “0”. Then the electronic terminal 102 , with use of the detection information generation unit 201 , stores the transmission flag set with the value “0” in correspondence with the generated detection information in the history management unit 205 (step S 40 ).
  • FIG. 8 shows the details of the update processing of step S 35 in FIG. 7 .
  • the electronic terminal 102 calculates a defense level pertaining to a security strength for each protection path including one or more protection measures that have been attacked, excluding the protection measure to which the attack has been detected (step S 100 ).
  • the electronic terminal 102 judges whether an update is required by comparing each of the defense levels calculated by the defense level calculation unit 207 to the value of the protected property 250 (step S 105 ).
  • step S 105 When an update is judged to be required (“YES” in step S 105 ), the electronic terminal 102 , with use of the update location determination unit 209 , determines one or more locations requiring an update, and a defense level required for each of the one or more update locations, based on a security implementation model of the security state after the attack (step S 110 ).
  • the electronic terminal 102 with use of the update request generation unit 210 , generates update request information constituted from the one or more update locations determined by the update location determination unit 209 , the required defense level, and the management ID (step S 115 ), and transmits the generated update request information to the server 101 (step S 120 ).
  • the electronic terminal 102 receives, from the server 101 , the new secure information determined based on the transmitted update request information, new model information indicating the secure information, and one or more new monitoring units (step S 125 ).
  • the electronic terminal 102 updates the secure information currently stored in the secure storage (the secure information storage unit 216 ) with the new secure information received by the protection method reception unit 212 . Also, the electronic terminal 102 , with use of the protection method update unit 213 , updates the model information 230 stored in the current model storage unit 206 with the new model information received by the protection method reception unit 212 (step S 130 ). Also, to monitor the one or more new protection measures included in the new secure information, the electronic terminal 102 stores the received one or more monitoring units in a predetermined storage area of the electronic terminal 102 , with use of the protection method update unit 213 .
  • step S 105 When a judgment is made that an update is not required (“NO” in step S 105 ), the electronic terminal 102 ends the processing.
  • the server 101 with use of the detection information reception unit 312 , receives one or more detection information pieces with attached signature data and the management ID from the electronic terminal 102 (step S 200 ).
  • the server 101 with use of the detection information reception unit 312 , verifies the signature of the received detection information (step S 205 ).
  • the server 101 If the authenticity of the received detection information is confirmed by the signature verification (“OK” in step S 205 ), the server 101 , with use of the detection information reception unit 312 , stores the received one or more detection information pieces, in correspondence with the received management ID, in the history management unit 304 (step S 210 ).
  • the server 101 Upon receiving the update request information from the electronic terminal 102 (step S 215 ), the server 101 , with use of the protection method selection unit 306 , selects new secure information, new model information corresponding to the new secure information, and one or more monitoring units appropriate for transmitting from the protection method storage unit 308 to the electronic terminal 102 , based on the location requiring an update and the defense level required for the location included in the received update request information (step S 220 ).
  • the server 101 with use of the protection method delivery unit 310 , transmits the new model information, new secure information, and one or more new monitoring units selected by the protection method selection unit 306 , to the electronic terminal 102 pertaining to the update request (step S 225 ).
  • the server 101 performs an operation to update the model identifier corresponding to the management ID of the electronic terminal 102 that is the transmission destination currently stored in the secure storage area, with a model identifier corresponding to the acquired new model information.
  • the server 101 ends the processing.
  • Embodiment 2 differs from Embodiment 1 in that when an attack is detected, the processing such as calculating the defense levels and determining the update locations is performed by the server.
  • FIG. 10 shows an overall structure of the unauthorized-analysis prevention system 2 of Embodiment 2 of the present invention.
  • the unauthorized-analysis prevention system 2 includes a server 1101 and electronic terminals 1102 a , . . . , 1102 b , and the server 1101 performs communication with the electronic terminals 1102 a , . . . , 1102 b via a network 1103 .
  • an electronic terminal 1102 As an exemplary one of the electronic terminals 1102 a , . . . , 1102 b.
  • the electronic terminal 1102 stores a property that is not to be released to a third party, and manages the property with use of a plurality of protection measures.
  • the electronic terminal 1102 monitors against an unauthorized attack by an external source on the plurality of protection measures. If an unauthorized attack is detected, the electronic terminal 1102 generates detection information to that effect, and transmits the generated detection information to the server 1101 . At this time, if transmission cannot be performed to the server 1101 , the electronic terminal 1102 stores the generated detection information in its own secure storage that can safely preserve the information.
  • the server 1101 Upon receiving the detection information from the electronic terminal 1102 , the server 1101 stores the received detection information.
  • the server 1101 judges whether to add a new protection measure. When the judgment is affirmative, the server 1101 determines an update location and calculates a required defense level, and transmits new secure information based on the determined update location and defense level to the electronic terminal 1102 to which the attack was detected.
  • the following describes the structure of the electronic terminal 1102 .
  • the electronic terminal 1102 includes a detection information generation unit 1201 , a signature attachment unit 1202 , a date and time information acquisition unit 1203 , a storage destination selection unit 1204 , a history management unit 1205 , monitoring units 1211 a , 1211 b , . . . , 1211 n , a protection method reception unit 1212 , a protection method update unit 1213 , a transmission unit 1214 , an identifier storage unit 1215 , and a secure information storage unit 1216 .
  • the identifier storage unit 1215 stores a management ID for identifying the electronic terminal 1102 .
  • the following describes the monitoring units 1211 a , 1211 b , . . . , and 1211 n.
  • monitoring unit 1211 as an exemplary one of the monitoring units 1211 a , 1211 b , . . . , and 1211 n.
  • the monitoring unit 1211 monitors whether the protection measure targeted for monitoring has been attacked by an external source.
  • the monitoring unit 1211 notifies the detection information generation unit 1201 of the attack and the protection identifier of the protection measure targeted for monitoring.
  • the monitoring unit 1211 is described.
  • history management table T 100 shown in FIG. 4 is used where necessary in the following description.
  • the detection information generation unit 1201 is similar to the detection information generation unit 201 described in Embodiment 1, description thereof is omitted here.
  • the signature attachment unit 1202 is similar to the signature attachment unit 202 described in Embodiment 1, description thereof is omitted here.
  • the storage destination selection unit 1204 is similar to the storage destination selection unit 204 described in Embodiment 1, description thereof is omitted here.
  • the protection method reception unit 1212 receives, from the server 1101 , new secure information pertaining to a new protection measure applied to the protected property 250 or the key 251 shown in FIG. 3 , and one or more monitoring units.
  • the reception unit 1302 Upon receiving the one or more pieces of detection information with the signature data attached and the management ID from the electronic terminal 1102 via the network 1103 , the reception unit 1302 outputs the received one or more pieces of detection information with the signature data attached and the management ID to the detection information reception unit 1312 .
  • the detection information reception unit 1312 Upon receiving the one or more detection information pieces with signature data attached and the management ID from the reception unit 1302 , the detection information reception unit 1312 acquires the public key (PK) corresponding to the received management ID.
  • PK public key
  • the detection information reception unit 1312 verifies the signature data corresponding to the one or more detection information pieces received with use of the acquired public key. Note that since signature verification is known technology, description thereof is omitted here.
  • the detection information reception unit 1312 stores the received one or more detection information pieces in correspondence with the received management ID in the history management unit 1304 .
  • history management table T 200 shown in FIG. 6 is used where necessary in the following description.
  • the model storage unit 1314 stores, for each of the electronic terminals 1102 a , . . . , 1102 b , security implementation model information (hereinafter referred to simply as model information), pertaining to security measures currently applied in that electronic terminal. Specifically, the model information is stored in correspondence with the management ID.
  • model information security implementation model information
  • model information 230 shown in FIG. 3 is used in the following description where necessary.
  • the update requirement judgment unit 1318 Upon receiving a judgment instruction, the management ID, and the one or more protection identifiers from the detection information reception unit 1312 , the update requirement judgment unit 1318 outputs, to the defense level calculation unit 1316 , the received one or more protection identifiers, the management ID, and a calculation instruction to calculate a defense level.
  • the update requirement judgment unit 1318 Upon receiving the one or more calculated defense levels from the defense level calculation unit 1316 , the update requirement judgment unit 1318 acquires the value of the protected property 250 from the model information 230 stored in the model storage unit 1314 . Then the update requirement judgment unit 1318 compares each of the acquired values to the received defense level.
  • the update requirement judgment unit 1318 When a judgment is made that the defense level is less than or equal to the value of the property 250 , the update requirement judgment unit 1318 outputs the update location determination instruction to determine an update location, the management ID, and the one or more protection identifiers received from the detection information reception unit 1312 to the update location determination unit 1320 .
  • the defense level calculation unit 1316 receives the calculation instruction, the management ID, and one or more protection identifiers from the update requirement judgment unit 1318 .
  • the defense level calculation unit 1316 calculates a defense level pertaining to a security strength of the protection path excluding the protection measure to which the attack has been detected.
  • the update location determination unit 1320 determines, based on the security implementation model of the security state after the attack, one or more locations requiring an update and the defense level required for each of the one or more update locations.
  • the protection method storage unit 1308 stores a plurality of protection methods that can be used by the electronic terminal 1102 , organized by management ID.
  • the protection method storage unit 1308 stores a plurality of types of model information, each having a different protection pattern by which the electronic terminal 1102 protects the property 250 .
  • each piece of the model information includes a management ID, a model identifier identifying the piece of model information, and a secure information piece indicating the model information, in correspondence with each other.
  • the model information stored in the protection method storage unit 1308 is, for example, the model information 230 shown in FIG. 3 , model information in which the property 250 is protected by an encryption that is different from the encryption 232 indicated by the model information 230 , model information in which a certain protection measure exists between the code obfuscation 243 and the debugger disabling 242 indicated by the model information 230 , etc.
  • the protection method storage unit 1308 stores a corresponding monitoring unit for monitoring the protection measure.
  • the protection method selection unit 1306 receives, from the update location determination unit 1320 , the management ID, the one or more update locations and the defense level corresponding to each of the one or more update locations.
  • the protection method selection unit 1306 selects, based on the received one or more update locations and the defense level corresponding to each of the update locations, a protection method and one or more monitoring units appropriate for transmitting from the protection method storage unit 1308 to the electronic terminal 1102 .
  • the protection method selection unit 1306 stores the model identifiers corresponding to the model information stored in the electronic terminal 1102 , in correspondence with the management ID of the electronic terminal 1102 , in a secure storage area.
  • the protection method selection unit 1306 acquires a model identifier corresponding to the received management ID from the secure storage area.
  • the protection method selection unit 1306 acquires a new monitoring unit corresponding to each of the one or more new protection measures included in the acquired new secure information.
  • the protection method selection unit 1306 transmits the acquired new secure information and one or more new monitoring units to the electronic terminal 1102 to which an attack was detected, via the protection method delivery unit 1310 .
  • the protection method selection unit 1306 replaces, that is to say updates, the model information that is stored in the model storage unit 1314 and corresponds to the received management ID with the acquired new model information.
  • the protection method selection unit 1306 replaces, that is to say updates, the model identifier corresponding to the management ID of the electronic terminal 1102 that is the transmission destination currently stored in the secure storage unit with the model identifier corresponding to the acquired new model information.
  • the protection method delivery unit 1310 Upon receiving the new secure information from the protection method selection unit 1306 , the protection method delivery unit 1310 transmits the received new secure information to the electronic terminal 1102 to which an attack was detected, via the network 1103 .
  • the following describes the operations of the electronic terminal 1102 while monitoring for an attack from an external source.
  • the following describes update processing performed by the electronic terminal 1102 with use of the flowchart shown in FIG. 13 .
  • the protection method reception unit 1212 of the electronic terminal 1102 receives updated new secure information and one or more new monitoring units from the server 1101 (step S 300 ).
  • the electronic terminal 1102 updates the secure information currently stored in the secure storage (secure information storage unit 1216 ) with new secure information received by the protection method reception unit 1212 (step S 305 ). Also, at this time, the electronic terminal 1102 , with use of the protection method update unit 1213 , stores the one or more received monitoring units for monitoring the one or more new protection measures included in the new secure information in a predetermined storage area in the electronic terminal 1102 .
  • the server 1101 with use of the detection information reception unit 1312 , receives the one or more detection information pieces with signature data attached and the management ID from the electronic terminal 1102 (step S 350 ).
  • the server 1101 with use of the detection information reception unit 1312 , performs signature verification on the received detection information (step S 355 ).
  • the server 1101 If the authenticity of the received detection information is verified by the signature verification (“OK” in step S 355 ), the server 1101 , with use of the detection information reception unit 1312 , stores each of the received one or more detection information pieces in correspondence with the received management ID in the history management unit 1304 (step S 360 ).
  • the server 1101 calculates a defense level pertaining to the security strength of each path including one or more protection measures to which an attack has been detected, excluding the one or more protection measures to which the attack has been detected (step S 365 ).
  • the server 1101 judges whether an update is required by comparing each of the defense levels calculated by the defense level calculation unit 1316 to the value of the protected property 250 (step S 370 ).
  • the server 1101 determines one or more locations requiring an update and a defense level required for each of the update locations, based on the security implementation model corresponding to the electronic terminal 1102 for which the detection information was transmitted, that is, the electronic terminal 1102 to which the attack was detected (step S 375 ).
  • the server 1101 with use of the protection method selection unit 1306 , selects new secure information, new model information corresponding to the new secure information, and one or more new monitoring units from the protection method storage unit 1308 based on the determined one or more locations requiring an update and the defense level required for each of the update locations (step S 380 ).
  • the server 1101 with use of the protection method delivery unit 1310 , transmits the new model information and one or more new monitoring units selected by the protection method selection unit 1306 to the electronic terminal 1102 to which the attack was detected (step S 385 ).
  • the server 1101 with use of the protection method selection unit 1306 , updates the model information that is stored in the model storage unit 1314 and corresponds to the received management ID with the new acquired model information (step S 390 ).
  • the server 1101 with use of the protection method selection unit 1306 , performs an operation to update the model identifier corresponding to the management ID of the electronic terminal 1102 that is the transmission destination currently stored in the secure storage area with the model identifier corresponding to the new acquired model information.
  • the server 1101 ends the processing.
  • an encryption 244 may be added as a new protection measure between the code obfuscation 243 and the debugger disabling 242 on the second protection path 261 .
  • the key 251 is code-obfuscated, and furthermore is protected in a state of being encrypted. Since another key is required for decrypting the encryption, a key 252 is added as a new associated property to the new secure information. If not protected, the key 252 can be acquired easily. In that case, adding the encryption 244 to strengthen the protection path 261 becomes meaningless. In view of this, it is necessary to protect the key 252 that has become the new associated property.
  • FIG. 15 shows specific model information 230 a pertaining to this case.
  • the encryption 244 has been added as a new protection measure between the code obfuscation 243 and the debugger disabling 242 , and as a result of this addition, the key 252 that is a new associated property of has been added.
  • the key 252 is protected by the code obfuscation 245 as a protection measure.
  • monitoring units 211 f and 211 g have also been added to monitor the added encryption 244 and the code obfuscation 245 .
  • a third protection path 262 to reach the property 250 is newly formed, and the defense level of the third protection path 262 is “12”.
  • the defense level of the second protection path 261 has changed from “17” to “12”.
  • Embodiment 3 The following describes Embodiment 3 with a focus on aspects that are different from Embodiment 1.
  • Embodiment 3 also includes cases of updating the protection method for a version upgrade of the protection measures, and updating the protection method when the defense level of a protection measure has been reduced due to success of deciphering the encryption, deciphering a code that has been code-obfuscated, etc.
  • the following describes the structure of the electronic terminal 102 A.
  • the electronic terminal 102 A includes the detection information generation unit 201 , the signature attachment unit 202 , the date and time information acquisition unit 203 , the storage destination selection unit 204 , the history management unit 205 , the model storage unit 206 , the monitoring units 211 a , 211 b , . . .
  • the identifier storage unit 215 the secure information storage unit 216 , a defense level calculation unit 207 A, an update requirement judgment unit 208 A, an update location determination unit 209 A, an update request generation unit 210 A, a protection method reception unit 212 A, a protection method update unit 213 A, a transmission unit 214 A, a defense level table storage unit 220 A, a comparison unit 221 A, and a protection measure correspondence table storage unit 222 A.
  • model storage unit 206 stores therein model information 230 A shown in FIG. 17 .
  • the difference between the model information 230 A and the model information 230 described in Embodiment 1 (see FIG. 3 ) is the value of the property.
  • the value of the property 250 is “10”, and in the present description, the value of the property 250 A is “15”.
  • the defense level table storage unit 220 A stores therein a defense level table T 300 received by the protection method reception unit 212 A from the server 101 A.
  • the defense level table T 300 includes an area for storing a set constituted from a protection measure management ID, a protection measure, and a defense level.
  • the protection measure management ID is for uniquely identifying a single protection measure.
  • the entry in the “protection measure” field indicates the name of the protection measure corresponding to the protection measure management ID.
  • the entry in the “defense level” field indicates the defense level of the protection measure.
  • the protection measure correspondence table storage unit 222 A stores therein a protection measure correspondence table T 400 that correlates one or more protection measures included in the model information 230 to the protection measure included in the defense level correspondence table.
  • the protection measure management ID is for uniquely identifying a single protection measure
  • the entry in the “protection measure” field indicates the name of the protection measure corresponding to the protection measure management ID.
  • the “point of use” indicates a position in the model information 230 where the corresponding protection measure is located, and in the present description, the “point of use” is the protection identifier described in Embodiment 1.
  • the comparison unit 221 A compares the defense level of the protection measures included in the model information 230 , that is, the defense level of the protection measures currently protecting the property 230 (hereinafter referred to as the “first defense level”), to the defense level corresponding to the protection measures included in the defense level table T 300 (hereinafter referred to as the “second defense level”), and judges whether the second defense level is less than the first defense level.
  • the comparison unit 221 A specifies the protection path including the protection measures.
  • the comparison unit 221 A specifies the first protection path 260 as the protection path including the encryption 232 .
  • the comparison unit 221 A specifies one or more protection paths in accordance with the results of the comparison.
  • the defense level calculation unit 207 A performs the following operations.
  • the defense level calculation unit 207 A calculates the defense level of the protection path, with use of the second defense level corresponding to the protection measure that has the reduced defense level.
  • the defense level calculation unit 207 A calculates “12” as the defense level of the first protection path 260 including the encryption 232 that has the reduced defense level.
  • the update requirement judgment unit 208 A In addition to the content of the operations of the update requirement judgment unit 208 described in Embodiment 1, the update requirement judgment unit 208 A also performs the following operations.
  • the update requirement judgment unit 208 A determines whether an update is required, based on the defense level calculated by the defense level calculation unit 207 A and the value of the property 250 A. Note that the method of judgment is the same as in Embodiment 1.
  • the update requirement judgment unit 208 A compares the defense level “12” calculated for the first protection path 260 to the value “15” of the property 250 A, and as a result of the comparison, judges whether an update is required.
  • the update location determination unit 209 A performs the following operations.
  • the update location determination unit 209 A specifies a new protection measure that can be used instead of the protection measure that has the reduced defense level. Note that when there are a plurality of protection paths judged to require an update, a new protection measure is specified for each protection path.
  • the update location determination unit 209 A specifies a new protection measure which will cause the defense level of the protection path to be greater than or equal to the value of the property.
  • the update location determination unit 209 A specifies an encryption B from the defense level table T 300 so that the defense level of the protection path will exceed the value “15” of the property 250 A.
  • the defense level of the first protection path 260 increases from “12” to “18”, which exceeds the value “15” of the property 250 A.
  • the update request generation unit 210 A In addition to the content of the operations performed by the update request generation unit 210 A described in Embodiment 1, the update request generation unit 210 A also performs the following operations.
  • the update request generation unit 210 A When the update location specification unit 209 A has specified the new protection measure that can be used instead of the protection measure that has the reduced defense level, the update request generation unit 210 A generates a second update request information piece constituted from a protection measure management ID corresponding to the protection measure, a protection identifier corresponding to the protection measure that has the reduced defense level, and a management ID stored in the identification storage unit 215 , and transmits the generated second update request information to the server 101 A via the transmission unit 214 .
  • the update request generation unit 210 A when there are a plurality of protection paths judged to require an update, the update request generation unit 210 A generates second update request information that is a set of information including a protection measure management ID of the new protection measure, and a protection identifier of the protection measure targeted to be updated to the new protection measure, for each of the new protection measures specified for each of the protection paths.
  • the transmission unit 214 A In addition to the content of the operations of the transmission unit 214 described in Embodiment 1, the transmission unit 214 A also performs the following operation.
  • the transmission unit 214 A transmits the second update request information generated by the update request generation unit 210 A to the server 101 A.
  • the protection method reception unit 212 A In addition to the content of the operations of the protection method reception unit 212 described in Embodiment 1, the protection method reception unit 212 A also performs the following operations.
  • the protection method reception unit 212 A receives the defense level table T 300 from the server 101 A.
  • the protection method reception unit 212 receives, from the server 101 A, one or more protection measures determined based on the transmitted second update request information piece, and one or more new monitoring units corresponding to the one or more protection measures.
  • the protection method reception unit 212 A receives, from the server 101 A, new secure information, new model information indicating the new secure information, and one or more new monitoring units, pertaining to the new protection measure for the protected property 250 A or the key 251 .
  • the protection method reception unit 212 A further receives a new protection measure correspondence table based on the protection measure management ID corresponding to each of the one or more protection measures included in the new secure information, the protection measure corresponding to the protection measure management ID, and the point of use.
  • the protection method update unit 213 A also performs the following operations.
  • the protection method update unit 213 A stores the defense level table T 300 received by the protection method reception unit 212 A in the defense level table storage unit 220 A.
  • the protection method update unit 213 A updates the currently stored secure information with new secure information, updates the currently stored model information 230 with new model information, and stores the received one or more monitoring units in a predetermined storage area in the electronic terminal 102 for monitoring the one or more new protection measures. Note that when a program for decryption processing of the secure information is included, the program is stored in a predetermined area.
  • the protection method update unit 213 A updates the protection measure correspondence table stored in the current protection measure correspondence table storage unit 222 A with the new protection measure correspondence table received by the protection method reception unit 212 A.
  • the server 101 A includes the history management unit 304 , the detection information reception unit 312 , a reception unit 302 A, a protection method selection unit 306 A, a protection method storage unit 308 A, a protection method delivery unit 310 A, and a defense level table storage unit 311 A.
  • the reception unit 302 A performs the following operations.
  • the reception unit 302 A Upon receiving the second update request information from the electronic terminal 102 A, the reception unit 302 A outputs the received second update request information to the protection method selection unit 306 A.
  • the protection method storage unit 308 A stores a plurality of types of model information, each having a different protection pattern by which the electronic terminal 102 A protects the protected property 250 A. Also, similarly to the protection method storage unit 308 described in Embodiment 1, the protection method storage unit 308 A stores secure information corresponding to each of these pieces of model information.
  • the protection method storage unit 308 A stores a protection measure correspondence table corresponding to each of the plurality of types of model information.
  • the protection method storage unit 308 A stores a monitoring unit for monitoring each of the protection measures.
  • the protection method selection unit 306 A also performs the following operations.
  • the protection method selection unit 306 A Upon receiving the second update request information from the reception unit 302 A, the protection method selection unit 306 A, with use of one or more sets including a protection measure management ID and a protection identifier included in the received second update request information, acquires model information and a protection measure correspondence table corresponding to the model information from the protection method storage unit 308 A.
  • the protection method selection unit 306 A acquires, from the protection method storage unit 308 A, model information in which protection measures identified by each of the protection measure IDs in the second update request information are in locations specified by corresponding protection identifiers (protection identifiers included in the set including the protection measure management ID).
  • the protection method selection unit 306 A acquires the secure information and the protection measure correspondence table corresponding to the acquired model information.
  • the protection method selection unit 306 A further acquires a new monitoring unit corresponding to each of the one or more new protection measures included in the acquired new secure information.
  • the protection method selection unit 306 A transmits the acquired new model information, a protection measure correspondence table corresponding to the new model information, the new secure information and the one or more monitoring units to the electronic terminal 102 A pertaining to the update request via the protection method delivery unit 310 A.
  • the protection method selection unit 306 A updates the model identifier corresponding to the management ID of the electronic terminal 102 A that is the transmission destination currently stored in the secure storage area with the model identifier corresponding to the new acquired model information.
  • the defense level table storage unit 311 A stores a defense level table to be transmitted to the electronic terminal 102 A.
  • the protection method delivery unit 310 A performs the following operation.
  • the protection method delivery unit 310 A transmits the defense level table stored in the defense level table storage unit 311 A to the electronic terminal 102 A.
  • the protection method delivery unit 310 A transmits, to the electronic terminal 102 A, the new model information acquired by the protection method selection unit 306 A, the protection measure correspondence table corresponding to the new model information, the new secure information and the one or more monitoring units.
  • the protection method delivery unit 310 A includes a decryption processing program in the secure information, similarly to the protection method delivery unit 310 described in Embodiment 1.
  • the following describes the processing pertaining to updating the secure information when the defense level of the protection measure has been reduced, with reference to FIG. 21 .
  • the protection method reception unit 212 A of the electronic terminal 102 A receives the defense level table from the server 101 A, and stores the received defense level table in the defense level table storage unit 220 A (step S 500 ).
  • the comparison unit 220 A compares the first defense level of the protection measure to the second protection level corresponding to the protection measure in the defense level table T 300 , and judges whether the second defense level is less than the first defense level. If the judgment is affirmative, the comparison unit 221 A specifies which protection path includes each protection measure for which the second defense level is less than the first defense level (step S 505 ).
  • the defense level calculation unit 207 A calculates a defense level indicating a security strength of the protection path excluding the attacked protection measure.
  • the update requirement judgment unit 208 A compares each of the defense levels calculated by the defense level calculation unit 207 A to the value of the protected property 250 , and judges whether an update is required (step S 510 ).
  • the update location determination unit 209 A of the electronic terminal 102 A specifies a new protection measure so that the defense level of the protection path to be updated becomes greater than the property value, with use of the model information 230 A stored in the model storage unit 206 , and the defense level table T 300 stored in the defense level table storage unit 220 A (step S 515 ).
  • the update request generation unit 210 A generates second update request information as a single set including a protection measure management ID of a new protection measure and a protection identifier of a protection measure to be updated on the protection path, for each new protection measure specified on each protection path (step S 520 ).
  • the transmission unit 214 A transmits the generated second update request information to the server 101 A (step S 525 ).
  • the protection method reception unit 212 A receives, from the server 101 A, new secure information determined based on the transmitted second update request information, new model information indicating the new secure information, a protection measure correspondence table corresponding to the new model information, and one or more monitoring units (step S 530 ).
  • the protection method update unit 213 A updates the secure information currently stored in the secure information storage unit 216 to the new secure information received by the protection method reception unit 212 , updates the model information 230 stored in the current model storage unit 206 to the new model information received by the protection method reception unit 212 , and updates the protection measure correspondence table stored in the current protection measure correspondence table storage unit 222 A to a new protection measure correspondence table received by the protection method reception unit 212 A (step S 535 ). Also, at this time, the protection method update unit 213 A stores the received one or more monitoring units in a predetermined storage area in the electronic terminal 102 A to monitor the one or more new protection measures included in the new secure information.
  • step S 510 If it is judged that an update is not required (“NO” in step S 510 ), the electronic terminal 102 A ends the processing.
  • the server 101 A receives the second update request information from the electronic terminal 102 A (step S 600 ).
  • the protection method selection unit 306 A of the server 101 A selects new secure information, new model information corresponding to the new secure information, and one or more new monitoring units appropriate for transmitting from the protection method storage unit 308 A to the electronic terminal 102 A (step S 605 ).
  • the protection method delivery unit 310 A transmits, to the electronic terminal 102 A pertaining to the update request, the new model information, the new secure information, and the one or more new monitoring units selected by the protection method selection unit (step S 610 ).
  • the protection method selection unit 306 A of the server 101 A performs an operation to update the model identifier corresponding to the management ID of the electronic terminal 102 A that is the transmission destination currently stored in the secure storage area to the model identifier corresponding to the acquired new model information.
  • protection measures may also be deleted. For example, when a protection measure has undergone unauthorized analysis, that protection measure is likely to be already broken and therefore useless to leave in place. In this case, the capacity of the electronic terminal 102 can be used more effectively by deleting this protection measure.
  • the new protection measure may be used to overwrite the protection measure that underwent unauthorized analysis.
  • Embodiments 1 and 2 describe a case of updating a protection measure only when an unauthorized attack has occurred, the present invention is not limited to this.
  • the electronic terminal may strengthen the defense level by acquiring a new protection measure that becomes available when the electronic terminal accesses the server, either periodically or in response to an instruction from a user or a program.
  • the electronic terminal acquires the new property from the server, and updates the currently stored property with the new property.
  • the electronic terminal may perform an update by replacing each protection measure with a protection measure having the same defense level, either periodically or in response to an instruction from a user or a program.
  • a protection measure may also be replaced with a protection measure having a stronger defense level instead of a protection measure having the same defense level.
  • the higher the defense level of a protection measure the longer the execution time generally is for that protection measure, so a structure that maintains defense levels at the minimum necessary is preferable from the standpoint of operation speed of the electronic terminal.
  • some of the protection measures may be updated with protection measures having a lower defense level, as long as doing so would not result in reducing the defense level of the protection path as a whole.
  • each protection measure added in an update is determined so that by adding the protection measure, the defense level of the protection path becomes greater than the property value.
  • the invention is not limited to this example, and for example, the locations to be updated and the necessary defense levels may be determined without comparing the property value to the defense level. Specifically, this may be achieved by analyzing the defense level of each protection path, and if a protection path is discovered that has a weaker defense level than the other protection paths, adding a protection measure to that protection path.
  • a protection measure may also be replaced with a protection measure having a stronger defense level instead of a protection measure having the same defense level.
  • the higher the defense level of a protection measure the longer the execution time generally is for that protection measure, so a structure that maintains defense levels at the minimum necessary is preferable from the standpoint of operation speed of the electronic terminal.
  • the electronic terminal may be configured to judge whether the defense level of the protection path is less than a threshold other than the property value, and depending on the result of this judgment, to add a protection measure to the protection path that has become less than the threshold.
  • the present invention is not limited to this.
  • the device may be configured so that regardless of whether the defense level is less than the property value, any protection measure that has undergone unauthorized analysis is updated.
  • the device may be configured to select a protection measure that has a stronger defense level than the protection measure that had undergone unauthorized analysis.
  • the device may be configured so that updating the property value is also possible.
  • the electronic terminal it is preferable for the electronic terminal to detect when the property value has been updated and to update the protection measures in accordance with the updated property value.
  • the monitoring units monitor whether the protection measures have been attacked. However, the monitoring units may further monitor whether the history management table has been illicitly overwritten.
  • the monitoring units monitor whether the protection measures have been attacked.
  • the monitoring units may further set a trap such as a honeypot, and monitor whether the honeypot trap is attacked.
  • the monitoring units monitor whether the protection measures have been attacked.
  • the electronic terminal may further record, in a history management table, normal operation record information indicating a time up to which each protection measure has been used normally, without any unauthorized tampering.
  • the normal operation record information need not be configured to accumulate continuously, but rather may be configured so that each time a new piece of normal operation record information is recorded, the new piece of normal operation record information overwrites a piece of previously recorded normal operation record information.
  • This normal operation record information is used to evaluate a degree of difficulty in attacking each protection measure or a model leading to each protection measure, for example.
  • the normal operation record information may be used as reference information for calculating defense levels of protection measures in the next model created.
  • the timing when the monitoring units of Embodiments 1 and 2 perform monitoring may be i) when the electronic terminal starts up, ii) before execution of each protection measure, iii) during execution of each protection measure, or iv) after execution of each protection measure. Also, monitoring may be performed according to a specified event pertaining to each protection measure, performed periodically, or performed at an irregular timing. For safer implementation, it is preferable for the timing of the monitoring to be unpredictable to an attacker.
  • the protection measures and the monitoring units are realized by programs.
  • the present invention is not limited to this.
  • the protection measures transmitted from the server may be setting data indicating an updated circuit structure of the reconfigurable processor or the like.
  • the electronic terminal 102 updates the circuit structure of the reconfigurable processor based on the received setting data.
  • the protection measures to be added in an update are stored by the server.
  • the electronic terminal may also be configured to store several protection measures as a precaution, and to self-repair with use of these stored protection measures.
  • the electronic terminal when storing a code obfuscation program as a protection measure, the electronic terminal obfuscates the encrypted property with use of the stored code obfuscation program.
  • the electronic terminal updates the currently stored secure information with code-obfuscated secure information.
  • the electronic terminal may further encrypt the encrypted property with use of the stored encryption program.
  • the device may be configured to first decrypt the current encryption of the property, and then to use the stored encryption program to encrypt the property.
  • the electronic terminal strengthens the protection state of the property to be protected
  • the present invention is not limited to this.
  • the electronic terminal may apply the stored protection measure to another property associated with the property to be protected (for example, the key 251 shown in FIG. 3 ), thereby strengthening the defense level thereof in the secure information.
  • the electronic terminal transmits detection information upon detecting an attack from an external source
  • the present invention is not limited to this.
  • the electronic terminal may periodically transmit detection information that is stored in the electronic terminal and has not been transmitted to the server.
  • the electronic terminal creates signature data for each of the one or more pieces of detection information transmitted to the server.
  • the present invention is not limited to this.
  • the signature attachment unit of the electronic terminal may be configured to concatenate one or more detection information pieces to be transmitted to the server, and to generate one piece of signature data for the concatenated detection information.
  • the server acquires new secure information in order to update the secure information stored in the electronic terminal
  • the present invention is not limited to this.
  • the server may instead be configured to extract only updated portions of the secure information, and to transmit the extracted portions to the electronic terminal.
  • the electronic terminal upon receiving the updated portions from the server, updates the locations to be updated with the received updated portions in the stored secure information.
  • the method of calculating the defense level is not limited to the method described in Embodiments 1 and 2.
  • the defense level may be calculated based on a level of technological skill required to perform analysis.
  • the defense level may be calculated based on a bit length of the property.
  • the defense level may be calculated on a scale of 1 to 5 or on a scale of 1 to 10, based on the severity of risk to a security system when analysis is performed.
  • the value of the property may also be assigned on a scale of 1 to 5 or on a scale of 1 to 10.
  • the model storage unit stores security implementation model information
  • the present invention is not limited to this.
  • the model storage unit may manage information such as version information of the security implementation model information.
  • Embodiments 1 and 2 describe a case in which one server corresponds to a plurality of electronic terminals, the present invention is not limited to this.
  • One server may be assigned to each electronic terminal.
  • the electronic terminal is not required to transmit the management ID to the server.
  • the server stores model information of the corresponding electronic terminal, secure information, model identifiers, etc.
  • Embodiment 1 when the electronic terminal detects an attack, the calculation of defense level, the judgment of whether an update is required, and the determination of the update location are performed by the electronic terminal. Also, in Embodiment 2, when the electronic terminal detects an attack, the calculation of the defense level, the judgment of whether an update is required, and the determination of the update location are performed by the server.
  • the allocation of functions is not limited to the method of allocation described in Embodiments 1 and 2.
  • the calculation of the defense level and the judgment of whether an update is required may be performed by the electronic terminal, and the determination of the update location may be performed by the server.
  • the calculation of defense level may be performed by the electronic terminal, and the judgment of whether an update is required and the determination of the update location may be performed by the server.
  • Embodiments 1 and 2 Although in Embodiments 1 and 2, one monitoring unit is assigned to each of the protection measures, the present invention is not limited to this.
  • One monitoring unit may monitor all the protection measures.
  • the monitoring unit may monitor whether an attack has occurred as a separate operation for each of the plurality of protection measures. Specifically, this can be realized by assigning a monitoring sub-unit for each protection measure, so that each monitoring sub-unit monitors for an attack on the corresponding protection measure.
  • Embodiments 1 and 2 information transmitted and received between the electronic terminal 102 and the server 101 may be encrypted.
  • the electronic terminal may remove that protection measure as a target for monitoring.
  • each time a protection measure and a monitoring unit are added the secure information is updated accordingly.
  • the protection measure to be added is a program or the like that does not permit access to an area that stores secure information except to a user who has a specified piece of information
  • the secure information itself does not change as a result of adding the protection measure.
  • the secure information need not be updated.
  • the electronic terminal may be configured to judge whether to update the secure information by checking the content of the protection measure to be added. Alternatively, control may be performed by attaching a flag, indicating whether the secure information requires an update, directly to the protection measure delivered from the server.
  • the defense level of a path is determined to be the sum of defense levels of the protection measures on the path.
  • the method of calculating the defense level of a path is not limited to this. For example, multiplication may be used instead of addition. Also, in a situation where there are two or more consecutive protection measures that are similar (encryption according to the same algorithm, etc.) on the same path, if one or more of the similar protection measures is broken, the remaining similar protection measures are likely to be broken too. Therefore, reducing the quantities to be summed, etc., may also be used in the calculation method.
  • the property 250 and the associated property are stored in the secure information storage unit 216 .
  • the present invention is not limited to this.
  • the property 250 and the associated property (the key 251 ) may each be stored in a different storage unit.
  • Embodiment 2 the same type of storage assignment may be used in Embodiment 2.
  • the associated property may be a key generation program for generating a decryption key.
  • a protection measure for example, encryption or code obfuscation
  • the key generation program may be used.
  • an attack to the protection measure is either an attack to encrypted data or an encrypted program directly, similarly to the specific examples given above, or an attack to a decryption program for decrypting the encrypted data or the encrypted program.
  • the decryption program for decrypting the encrypted data or program may be stored in the secure information storage unit 216 , or may be stored in a storage area other than the secure information storage unit 216 .
  • an attack to code obfuscation is an attack to the code-obfuscated program.
  • a program targeted for code obfuscation is, for example, a key generation program for generating a key, or a decryption program for decrypting encrypted data or an encrypted program.
  • a code-obfuscated program similarly to a decryption program, may be stored in a secure information storage unit 216 , or may be stored in a storage area other than the secure information storage unit 216 .
  • the devices described above may be computer systems structured specifically from a microprocessor, a ROM, a RAM, a hard disk unit, a display unit, a keyboard, a mouse, etc.
  • a computer program is stored in the RAM or the hard disk unit.
  • the devices achieve their functions as the microprocessor operates in accordance with the computer program.
  • the computer program is a combination of multiple instruction codes each indicating a command to the computer in order to achieve predetermined functions. Note that the present invention is not limited to being a computer system that includes all of the elements of a microprocessor, a ROM, a RAM, a hard disk unit, a display unit, a keyboard, a mouse, etc., and may include only some of these elements.
  • a portion or all of the constituent elements of the devices of the above embodiments and variations may be structured as a single system LSI (Large Scale Integration).
  • a system LSI is a super multifunctional LSI manufactured by integrating a plurality of structural units onto a single chip. Specifically, it is a computer system including a microprocessor, a ROM, a RAM, and the like. A computer program is stored in the RAM. The system LSI achieves its functions as the microprocessor operates in accordance with the computer program.
  • each constituent element included in the above-described devices may be on a separate chip, or some or all may be combined on a single chip.
  • an integrated circuit generated as described above may also be referred to as an IC, a system LSI, a super LSI, or an ultra LSI, depending on the degree of integration.
  • the method of integration is not limited to being LSI integration, but instead may be realized by a dedicated circuit or a general-purpose process. After LSI manufacture, the use of a field programmable gate array (FPGA) or a silicon flexible processor in which the connection and settings of circuit cells in the LSI can be restructured is possible.
  • FPGA field programmable gate array
  • a portion or all of the constituent elements of the devices of the above embodiments and modifications may be structured as a removable IC card or stand-alone module.
  • the IC card or the module is a computer system including a microprocessor, a ROM, and a RAM.
  • the IC card and the module may include the above super multifunctional LSI.
  • the IC card and the module achieve their functions as the microprocessor operates in accordance with the computer program. This IC card or module may be tamper resistant.
  • the present invention may be the methods shown above. Also, the present invention may be computer programs for causing computers to realize the methods, or may be digital signals representing the computer programs.
  • the present invention may be a computer-readable recording medium such as a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray Disc), or a semiconductor memory on which the computer programs or the digital signals are recorded.
  • the present invention may be the computer programs or the digital signals, which are recorded on these recording media.
  • the present invention may be the computer programs or digital signals which are transmitted via an electronic communications circuit, a wireless or fixed-line communications circuit, a network such as the Internet, a data broadcast, etc.
  • the present invention may be a computer system including a microprocessor and a memory, whereby the memory stores the computer programs, and the microprocessor operates in accordance with the computer programs.
  • the present invention may be carried out by another independent computer system by transferring the programs or the digital signals which have been recorded on the recording media, or by transferring the programs or the digital signals via the network, etc.
  • the present invention may be any combination of the above embodiments and modifications.
  • the present invention is an electronic terminal that stores confidential information protected by consecutive application of a plurality of protection measures for defense against an attack from a third party, the electronic terminal including one or more monitoring units for monitoring against an attack to each of the plurality of protection measures, an update judgment unit operable to judge whether to update a protection state of the confidential information when an attack is detected to one protection measure by one of the one or more monitoring units, and an update unit operable to, when the judgment by the update judgment unit is affirmative, update the protection state of the confidential information to a new protection state.
  • the electronic terminal upon detecting an attack to a protection measure from an external source and judging that an update of the protection state is necessary, the electronic terminal can protect against falsification of confidential information by a third party, since the confidential information is protected in a new protection state in which either a new protection measure has been added to the sequence of protection measures from the protection measure to which an attack was detected to the confidential information, or an existing protection measure in the sequence has been strengthened.
  • the update unit may update the protection state of the confidential information to a new protection state by replacing confidential information protected in a current protection state with confidential information protected in a new protection state.
  • a new protection measure has been added to a sequence from the one protection measure to which an attack was detected to the confidential information, or existing protection measures that have not been attacked in the sequence have been strengthened.
  • the electronic terminal replaces confidential information stored in the current protection state with confidential information stored in a new protection state. Therefore, a third party cannot easily tell the difference between the protection state before the replacement and the protection state after the replacement.
  • the electronic terminal may further include a communication judgment unit operable to judge whether communication can be performed with an external device via a network, and a transmission unit operable to, if the judgment is affirmative, transmit detection information to the external device indicating that an attack to the one protection measure has been detected.
  • the update unit may receive, from the external device, confidential information protected in the new protection state in which a location to be updated in the sequence of protection measures has been determined based on the detection information.
  • the electronic terminal can notify the external device that an attack has occurred. Also, the electronic terminal can receive confidential information that is protected in a new protection state according to the attacked location.
  • the electronic terminal may further include a storage unit that stores therein the detection information when the communication judgment unit has judged that transmission cannot be performed.
  • the transmission unit may be further operable to transmit the one or more untransmitted detection information pieces to the external device.
  • the electronic terminal when the electronic terminal cannot transmit the detection information to the external device, the electronic terminal can store therein the detection information and transmit the stored untransmitted detection information when transmission becomes possible.
  • the update judgment unit may include i) a calculation unit operable to calculate a defense level for a protection path of protection measures that have not been attacked between the one protection measure that has been attacked and the confidential information, with use of the defense levels of one or more protection measures on the path, and ii) an update judgment unit operable to compare the defense level of the protection path calculated by the calculation unit to the value, and when the defense level of the protection path is less than or equal to the value, to judge that the protection state of the confidential information is to be updated.
  • the electronic terminal calculates a defense level for the protection path from the one protection measure that has been attacked to the confidential information. With use of the calculated defense level and the value of the confidential information, the electronic terminal can determine whether an update is required. Accordingly, the electronic terminal can update the protection state to a sufficient necessary strength in accordance with the value of the confidential information to be protected.
  • the update unit may further include i) a determination unit operable to, when the judgment by the update judgment unit is affirmative, determine a location on the protection path for adding a new protection measure or replacing an existing protection measure with a new protection measure, and determine a required defense level of the new protection measure so that the defense level of the protection path is greater than the value, ii) an acquisition unit operable to acquire confidential information protected in the new protection state, in which either a new protection measure having the determined defense level has been added in the determined location, or the existing protection measure in the location has been replaced by a new protection measure, and iii) a replacement unit operable to replace confidential information protected in the current protection state with confidential information protected in the new protection state acquired by the acquisition unit.
  • the electronic terminal determines a location to add a new protection measure or to replace an existing protection measure with a new protection measure, and the defense level of the new protection measure. Accordingly, upon detecting an attack, the electronic terminal can add a new protection measure having a defense level such that the defense level of the protection path from the one protection measure that has been attacked to the confidential information is greater than the value of the confidential information.
  • the determination unit may transmit the determined location and the determined defense level to the external device that is connected to the network.
  • the acquisition unit may receive, from the external device, confidential information protected in the new protection state, in which either the new protection measure having the determined defense level has been added to the location, or the new protection measure having the defense level has replaced the existing protection measure in the location.
  • the electronic terminal can request, from an external device, confidential information protected in a new protection state, in which either a new protection measure having the transmitted defense level has been added to the determined location, or a new protection measure has been added in place of an existing protection measure in the determined location, by transmitting the location and defense level of the new protection measure that is added or the existing protection measure that is replaced with the new protection measure to the external device.
  • the determination unit may store therein path information indicating protection paths constituted from sequences of protection measures from each of the plurality of protection measures to the confidential information, and with use of the path information, may determine the location to add the new protection measure or the location to replace an existing protection measure with the new protection measure.
  • the electronic terminal with use of the path information, can easily determine a location to add a new protection measure or to replace the existing protection measure with the new protection measure.
  • the update unit may include a storage unit that stores therein the confidential information or a new protection measure to be used for protecting confidential information that is protected by one or more protection measures.
  • the acquisition unit may acquire confidential information protected by a new protection measure by adding the new protection measure stored in the storage unit to the determined location, or by replacing the existing protection measure in the location with the new protection measure, and generating the new protection state.
  • the electronic terminal upon detecting an attack from an external source, the electronic terminal can update the current protection state of the confidential information to a new protection state, independently without need for another device.
  • the update judgment unit makes a judgment to update the protection state.
  • the update unit stores path information indicating protection paths constituted from protection measures from each of the plurality of protection measures to the confidential information.
  • the update unit may further include i) a determination unit operable to, with use of the path information, determine a location to add a new protection measure or to replace an existing protection measure with a new protection measure in a sequence of protection measures that have not been attacked between the one protection measure that has been attacked and the confidential information, ii) an acquisition unit operable to acquire confidential information protected in a new protection state, in which either a new protection measure has been added in the determined location, or the existing protection measure in the location has been replaced by a new protection measure, and iii) a replacement unit operable to replace confidential information protected in a current protection state with confidential information protected in the new protection state acquired by the acquisition unit.
  • the electronic terminal upon detecting an attack to a protection measure from an external source, the electronic terminal can protect against falsification of confidential information by a third party, since the confidential information is protected in a new protection state in which either a new protection measure has been added to the sequence of protection measures that have not been attacked from the protection measure to which an attack was detected to the confidential information, or an existing protection measure in the sequence has been strengthened. Also, by using the path information, the electronic terminal can easily determine the location to add the new protection measure or to replace an existing protection measure with a new protection measure that is stronger than the existing protection measure.
  • the update judgment unit may judge that the protection state be updated.
  • the update unit may transmit, to the external device, detection information indicating that an attack to the one protection measure has been detected, and receive, from the external device, confidential information protected in a new protection state, in which either a new protection measure has been added to the sequence of protection measures that have not been attacked between the one protection measure to which an attack was detected and the confidential information, or an existing protection measure in the sequence has been replaced with a new protection measure.
  • the update unit may update the confidential information protected in the current protection state with confidential information protected in the received new protection state.
  • the electronic terminal upon receiving, from the external device, confidential information stored in a protection state in which a new protection measure has been added, the electronic terminal updates confidential information stored in the current protection state with confidential information stored in a new protection state. Therefore, a third party cannot easily tell the difference between the protection state before the replacement and the protection state after the replacement.
  • the update unit may update the protection state of the confidential information to a new protection state either by adding a new protection measure to the sequence of protection measures that have not been attacked between the one protection measure to which an attack has been detected to the confidential information, or by replacing an existing protection measure in the sequence of protection measures that have not been attacked with a new protection measure.
  • the electronic terminal can easily update the protection state merely by adding or strengthening a protection measure.
  • the present invention is a management device for managing an electronic terminal that stores confidential information protected by consecutive application of a plurality of protection measures for defense against an attack from a third party, the management device including a reception unit operable to receive detection information indicating that an attack to a one protection measure has been detected, an update judgment unit operable to judge whether to update a protection state of the confidential information that is protected by the plurality of protection measures stored by the electronic terminal to a new protection state in which either a new protection measure has been added to a sequence of protection measures from the one protection measure to which the attack was detected to the confidential information, or an existing protection measure in the sequence of protection measures that have not been attacked has been strengthened, an acquisition unit operable to, if the judgment is affirmative, acquire confidential information protected in a protection state in which either a new protection measure has been added to the protection path, or an existing protection measure has been strengthened, and a transmission unit operable to transmit, to the electronic terminal, confidential information protected in the new protection state acquired by the acquisition unit.
  • the management device upon receiving the detection information from the electronic terminal, judges whether updating the protection state is required, and if the judgment is affirmative, transmits confidential information to the electronic terminal in a new protection state in which either a new protection measure has been added to the sequence of protection measures that have not been attacked between the protection measure to which an attack was detected to the confidential information, or an existing protection measure in the sequence has been strengthened.
  • a new protection measure has been added to the sequence of protection measures that have not been attacked between the protection measure to which an attack was detected to the confidential information, or an existing protection measure in the sequence has been strengthened.
  • Each of the plurality of protection measures may have a corresponding defense level against an attack, and each confidential information piece may have a corresponding value.
  • the update judgment unit may include i) a calculation unit operable to calculate a defense level for the protection path, with use of one or more defense levels of one or more protection measures on the protection path, and ii) an update judgment unit operable to compare the defense level of the protection path calculated by the calculation unit to the value, and when the defense level of the protection path is less than or equal to the value, to make a judgment that the protection state of the confidential information is to be updated.
  • the management device calculates a defense level for the protection path from the protection measure to which the attack was detected to the confidential information.
  • the electronic terminal can determine whether an update is required with use of the calculated defense level and the value of the confidential information. Accordingly, the electronic terminal can update the protection state to a sufficient necessary strength according to the value of the confidential information to be protected.
  • the acquisition unit may further i) when a judgment is made by the update judgment unit to update, determine a location on the protection path for adding a new protection measure or replacing an existing protection measure with a new protection measure, and determine a required defense level of the new protection measure so that the defense level of the protection path is greater than the value, and ii) acquire confidential information protected in a new protection state, in which either a new protection measure having the determined defense level has been added in the determined location, or the existing protection measure in the location has been replaced by a new protection measure.
  • the management device determines the location and defense level of a new protection measure to be added or to replace an existing protection measure. Therefore, when an attack is detected, the management device can add the new protection measure or replace the existing protection measure, so that the defense level of the protection path from the protection measure to which the attack was detected to confidential information is greater than the value of the confidential information.
  • the acquisition unit may store therein path information indicating protection paths constituted from sequences of protection measures from each of the plurality of protection measures to the confidential information, and with use of the path information, may determine the location to add the new protection measure or the location to replace an existing protection measure with the new protection measure.
  • the management device with use of the path information, can easily determine the location to add a new protection measure or to replace an existing protection measure with a new protection measure.
  • the update judgment unit may make a judgment to update the protection state.
  • the acquisition unit may further determine a location for adding a new protection measure or replacing an existing protection measure with a new protection measure in the sequence of protection measures that have not been attacked between the one protection measure which has been attacked to the confidential information, and acquire confidential information protected in the new protection state in which either the new protection measure has been added at the determined location, or the existing protection measure at the location has been replaced with the new protection measure.
  • the management device upon receiving the detection information from the electronic terminal, determines the location to add the new protection measure or the location to replace an existing protection measure with a new protection measure, and transmit, to the electronic terminal, confidential information protected in a new protection state in which the new protection measure has been added to the determined location, or the new protection measure has replaced the existing protection measure in the determined location.
  • the electronic terminal can prevent falsification of the confidential information by a third party, since upon detecting an attack to a protection measure from an external source, the electronic device can protect the confidential information in a new protection state received from the external device.
  • the reception unit may receive, as the detection information, location information indicating a location to add a new protection measure, or a location of an existing protection measure to be replaced with a new protection measure, in a sequence of protection measures that have not been attacked between the one protection measure to which an attack has been detected and the confidential information.
  • the acquisition unit may acquire confidential information protected in the new protection state in which either a new protection measure has been added in the location indicated by the location information, or the existing protection measure in the location indicated by the location information has been replaced with a new protection measure.
  • the management device upon receiving the location information from the electronic terminal, transmits the confidential information to the electronic terminal, the confidential information being protected in a new protection state in which either a new protection measure has been added in the location indicated by the location information, or the existing protection measure in the location indicated by the location information has been replaced with a new protection measure.
  • the electronic terminal can prevent falsification of the confidential information by a third party, since upon detecting an attack to the protection measure from an external source, the electronic terminal can protect the confidential information in a new protection state received from the external device.
  • Each of the plurality of protection measures may have a corresponding defense level against an attack, and each confidential information piece may have a corresponding value.
  • the electronic terminal may i) calculate a defense level for a protection path with use of one or more defense levels of one or more protection measures on the protection path, and ii) with use of the calculated defense level and the value, determine a defense level required so that the defense level of the protection path becomes greater than the value.
  • the reception unit may further receive the determined defense level.
  • the acquisition unit may acquire confidential information protected by either adding a new protection measure having the determined defense level at the location indicated by the location information, or replacing an existing protection measure in the location indicated by the location information with the new protection measure.
  • the management device upon receiving the defense level from the electronic terminal, transmits confidential information to the electronic terminal, the confidential information being protected in a new protection state in which either a new protection measure having the received defense level has been added in the location indicated by the location information, or the existing protection measure in the location indicated by the location information has been replaced with a new protection measure.
  • the electronic terminal can prevent falsification of the confidential information by a third party, since upon detecting an attack to a protection measure from an external source, the electronic device can protect the confidential information in a new protection state. received from the external device.
  • the present invention is a management device for managing an electronic terminal that stores confidential information protected by consecutive application of a plurality of protection measures for defense against an attack from a third party, the management device including a reception unit operable to receive detection information indicating that an attack to a one protection measure has been detected, an update judgment unit operable to judge whether to update the confidential information that is protected by the plurality of protection measures stored by the electronic terminal to a new protection state in which either a new protection measure has been added to the sequence of protection measures from the one protection measure to which the attack was detected to the confidential information, or an existing protection measure in the sequence has been strengthened, an acquisition unit operable to, if the judgment is affirmative, acquire a new protection measure for strengthening the protection state of the confidential information, and a transmission unit operable to transmit the new protection measure acquired by the acquisition unit to the electronic terminal.
  • An electronic terminal or server of the present invention can be used operationally, continually, and repeatedly in manufacture and sales industries.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Storage Device Security (AREA)
US12/919,313 2008-03-25 2009-03-19 Electronic terminal, control method, computer program and integrated circuit Active 2030-01-30 US8438402B2 (en)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
JP2008077435 2008-03-25
JP2008-077435 2008-03-25
PCT/JP2009/001240 WO2009119049A1 (fr) 2008-03-25 2009-03-19 Terminal électronique, procédé de commande, programme d'ordinateur et circuit intégré

Publications (2)

Publication Number Publication Date
US20110004771A1 US20110004771A1 (en) 2011-01-06
US8438402B2 true US8438402B2 (en) 2013-05-07

Family

ID=41113260

Family Applications (1)

Application Number Title Priority Date Filing Date
US12/919,313 Active 2030-01-30 US8438402B2 (en) 2008-03-25 2009-03-19 Electronic terminal, control method, computer program and integrated circuit

Country Status (4)

Country Link
US (1) US8438402B2 (fr)
EP (1) EP2256661A4 (fr)
JP (1) JP4977778B2 (fr)
WO (1) WO2009119049A1 (fr)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8806187B1 (en) * 2009-12-03 2014-08-12 Google Inc. Protecting browser-viewed content from piracy
US20190044972A1 (en) * 2016-02-02 2019-02-07 Ntt Communications Corporation Control device, mitigation system, control method, and computer program

Families Citing this family (31)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7634584B2 (en) 2005-04-27 2009-12-15 Solarflare Communications, Inc. Packet validation in virtual network interface architecture
JP5681028B2 (ja) * 2010-04-26 2015-03-04 パナソニック株式会社 改ざん監視システム、管理装置及び管理方法
EP2385676B1 (fr) * 2010-05-07 2019-06-26 Alcatel Lucent Procédé d'adaptation de politiques de sécurité d'une infrastructure de système d'informations
TWI420339B (zh) * 2010-11-10 2013-12-21 Ind Tech Res Inst 軟體授權系統及方法
JP5776927B2 (ja) * 2011-03-28 2015-09-09 ソニー株式会社 情報処理装置及び方法、並びにプログラム
US9417894B1 (en) 2011-06-15 2016-08-16 Ryft Systems, Inc. Methods and apparatus for a tablet computer system incorporating a reprogrammable circuit module
US10742604B2 (en) * 2013-04-08 2020-08-11 Xilinx, Inc. Locked down network interface
US9426124B2 (en) 2013-04-08 2016-08-23 Solarflare Communications, Inc. Locked down network interface
US9483381B2 (en) * 2014-12-15 2016-11-01 Dell Products L.P. Obfuscating debugging filenames
US9807117B2 (en) 2015-03-17 2017-10-31 Solarflare Communications, Inc. System and apparatus for providing network security
US10841337B2 (en) 2016-11-28 2020-11-17 Secureworks Corp. Computer implemented system and method, and computer program product for reversibly remediating a security risk
US10735470B2 (en) 2017-11-06 2020-08-04 Secureworks Corp. Systems and methods for sharing, distributing, or accessing security data and/or security applications, models, or analytics
US10594713B2 (en) * 2017-11-10 2020-03-17 Secureworks Corp. Systems and methods for secure propagation of statistical models within threat intelligence communities
US10686872B2 (en) 2017-12-19 2020-06-16 Xilinx, Inc. Network interface device
US11165720B2 (en) 2017-12-19 2021-11-02 Xilinx, Inc. Network interface device
US10686731B2 (en) 2017-12-19 2020-06-16 Xilinx, Inc. Network interface device
JP2019149763A (ja) * 2018-02-28 2019-09-05 オムロン株式会社 データの処理方法、制御システム、制御装置
EP3570197A1 (fr) * 2018-05-16 2019-11-20 Gemalto Sa Système électronique et procédé pour empêcher des actions malveillantes sur un système de traitement du système électronique
US11003718B2 (en) 2018-06-12 2021-05-11 Secureworks Corp. Systems and methods for enabling a global aggregated search, while allowing configurable client anonymity
US10785238B2 (en) 2018-06-12 2020-09-22 Secureworks Corp. Systems and methods for threat discovery across distinct organizations
US10838763B2 (en) 2018-07-17 2020-11-17 Xilinx, Inc. Network interface device and host processing device
US10659555B2 (en) 2018-07-17 2020-05-19 Xilinx, Inc. Network interface device and host processing device
US11310268B2 (en) 2019-05-06 2022-04-19 Secureworks Corp. Systems and methods using computer vision and machine learning for detection of malicious actions
US11418524B2 (en) 2019-05-07 2022-08-16 SecureworksCorp. Systems and methods of hierarchical behavior activity modeling and detection for systems-level security
US11621974B2 (en) * 2019-05-14 2023-04-04 Tenable, Inc. Managing supersedence of solutions for security issues among assets of an enterprise network
US11381589B2 (en) 2019-10-11 2022-07-05 Secureworks Corp. Systems and methods for distributed extended common vulnerabilities and exposures data management
US11218360B2 (en) 2019-12-09 2022-01-04 Quest Automated Services, LLC Automation system with edge computing
US11522877B2 (en) 2019-12-16 2022-12-06 Secureworks Corp. Systems and methods for identifying malicious actors or activities
US11588834B2 (en) 2020-09-03 2023-02-21 Secureworks Corp. Systems and methods for identifying attack patterns or suspicious activity in client networks
US11528294B2 (en) 2021-02-18 2022-12-13 SecureworksCorp. Systems and methods for automated threat detection
CN115865535B (zh) * 2023-02-28 2023-05-23 网思科技股份有限公司 一种云安全管理方法、系统和存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2001016655A (ja) 1999-06-30 2001-01-19 Advanced Mobile Telecommunications Security Technology Research Lab Co Ltd 安全な携帯端末装置
JP2002334511A (ja) 2001-01-31 2002-11-22 Sony Computer Entertainment Inc コンピュータシステム及びその使用方法
JP2003524925A (ja) 1998-12-09 2003-08-19 ネットワーク アイス コーポレイション ネットワークおよびコンピュータシステムセキュリティを提供する方法および装置
JP2004206683A (ja) 2002-12-11 2004-07-22 Nihon Intelligence Corp システム管理装置、方法及びプログラム、管理サーバシステム及びその制御方法並びに保険方法、セキュリティプログラム、セキュリティ管理方法、コンピュータ及びサーバコンピュータ
US20090113552A1 (en) * 2007-10-24 2009-04-30 International Business Machines Corporation System and Method To Analyze Software Systems Against Tampering

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2003524925A (ja) 1998-12-09 2003-08-19 ネットワーク アイス コーポレイション ネットワークおよびコンピュータシステムセキュリティを提供する方法および装置
US20070022090A1 (en) * 1998-12-09 2007-01-25 Network Ice Corporation, Inc. Method and Apparatus for Providing Network and Computer System Security
JP2001016655A (ja) 1999-06-30 2001-01-19 Advanced Mobile Telecommunications Security Technology Research Lab Co Ltd 安全な携帯端末装置
JP2002334511A (ja) 2001-01-31 2002-11-22 Sony Computer Entertainment Inc コンピュータシステム及びその使用方法
US7698733B2 (en) 2001-01-31 2010-04-13 Sony Computer Entertainment Inc. Computer system and usage method thereof
JP2004206683A (ja) 2002-12-11 2004-07-22 Nihon Intelligence Corp システム管理装置、方法及びプログラム、管理サーバシステム及びその制御方法並びに保険方法、セキュリティプログラム、セキュリティ管理方法、コンピュータ及びサーバコンピュータ
US20090113552A1 (en) * 2007-10-24 2009-04-30 International Business Machines Corporation System and Method To Analyze Software Systems Against Tampering
US20090113549A1 (en) * 2007-10-24 2009-04-30 International Business Machines Corporation System and method to analyze software systems against tampering

Non-Patent Citations (5)

* Cited by examiner, † Cited by third party
Title
International Search Report issued Jun. 23, 2009 in International (PCT) Application No. PCT/JP2009/001240.
Ivan Balepin et al, Using Specefication-Based Intrusion Detection for authomated response LNCS vol. 2830: Recent Advances in Intrusion Detection, Jan. 1, 2003,pp. 136-154, XP 55031958. *
Ivan Balepin et al., "Using Specification-Based Intrusion Detection for Automated Response", LNCS vol. 2820: Recent Advances in Intrusion Detection, Jan. 1, 2003, pp. 136-154, XP55031958, D01:10, 1007/978-3-540-45248-5-8, ISBN:978-3-54-040878-9, Retrieved from the Internet: URL:http://www.springerlink.com/content/gt, VY0d0dexr50x1c/fulltext.pdf?MUD=MP [retrieved on Jul. 5, 2012], abstract, pp. 146-159, figure 3.
Ivan Balepin et al., "Using Specification-Based Intrusion Detection for Automated Response", LNCS vol. 2820: Recent Advances in Intrusion Detection, Jan. 1, 2003, pp. 136-154, XP55031958, D01:10, 1007/978-3-540-45248-5—8, ISBN:978-3-54-040878-9, Retrieved from the Internet: URL:http://www.springerlink.com/content/gt, VY0d0dexr50x1c/fulltext.pdf?MUD=MP [retrieved on Jul. 5, 2012], abstract, pp. 146-159, figure 3.
Supplementary European Search Report dated Jul. 17, 2012 in corresponding European Patent Application No. 09725211.8.

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8806187B1 (en) * 2009-12-03 2014-08-12 Google Inc. Protecting browser-viewed content from piracy
US9124560B1 (en) * 2009-12-03 2015-09-01 Google Inc. Protecting browser-viewed content from piracy
US20190044972A1 (en) * 2016-02-02 2019-02-07 Ntt Communications Corporation Control device, mitigation system, control method, and computer program
US10999315B2 (en) * 2016-02-02 2021-05-04 Ntt Communications Corporation Control device, mitigation system, control method, and computer program

Also Published As

Publication number Publication date
WO2009119049A1 (fr) 2009-10-01
JPWO2009119049A1 (ja) 2011-07-21
US20110004771A1 (en) 2011-01-06
JP4977778B2 (ja) 2012-07-18
EP2256661A1 (fr) 2010-12-01
EP2256661A4 (fr) 2012-08-15

Similar Documents

Publication Publication Date Title
US8438402B2 (en) Electronic terminal, control method, computer program and integrated circuit
CN106230851B (zh) 基于区块链的数据保全方法及系统
EP2038806B1 (fr) Procédé pour la détection d'intrusion
JP4939851B2 (ja) 情報処理端末、セキュアデバイスおよび状態処理方法
US7743413B2 (en) Client apparatus, server apparatus and authority control method
JP5453324B2 (ja) 不正モジュール特定装置、情報処理装置、不正モジュール特定方法、不正モジュール特定プログラム、集積回路、不正モジュール無効化システム、および不正モジュール無効化方法
US8683214B2 (en) Method and device that verifies application program modules
US8516574B2 (en) Software update system, management apparatus, recording medium, and integrated circuit
US20130039491A1 (en) Tampering monitoring system, management device, protection control module, and detection module
JP4796050B2 (ja) セキュア処理装置、及びセキュア処理システム
US20060174346A1 (en) Instrumentation for alarming a software product
US8370935B1 (en) Auditing a device
US8745735B2 (en) Monitoring system, program-executing device, monitoring program, recording medium and integrated circuit
US8707430B2 (en) Tampering monitoring system, management apparatus, and management method
US8769312B2 (en) Tampering monitoring system, protection control module, and detection module
JP2008503014A (ja) ソフトウェアのセキュリティ確保
Zheng et al. Security analysis of modern mission critical android mobile applications
US11574046B2 (en) Protecting a software program against tampering
CN106971105B (zh) 一种基于iOS的应用程序遭遇假面攻击的防御方法
KR101226615B1 (ko) 소프트웨어 난독화 장치 및 소프트웨어 보안처리 시스템
Jarvis et al. Inside a targeted point-of-sale data breach
Powers et al. Whitelist malware defense for embedded control system devices
Msgna et al. Secure application execution in mobile devices
CN111858114A (zh) 设备启动异常处理，设备启动控制方法、装置及系统
Jin et al. Forensic analysis for tamper resistant software

Legal Events

Date Code Title Description
AS Assignment

Owner name: PANASONIC CORPORATION, JAPAN

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:MATSUSHIMA, HIDEKI;MATSUZAKI, NATSUME;YOKOTA, KAORU;AND OTHERS;SIGNING DATES FROM 20100726 TO 20100727;REEL/FRAME:025469/0031

STCF Information on status: patent grant

Free format text: PATENTED CASE

FEPP Fee payment procedure

Free format text: PAYOR NUMBER ASSIGNED (ORIGINAL EVENT CODE: ASPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

FEPP Fee payment procedure

Free format text: PAYER NUMBER DE-ASSIGNED (ORIGINAL EVENT CODE: RMPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

Free format text: PAYOR NUMBER ASSIGNED (ORIGINAL EVENT CODE: ASPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

FPAY Fee payment

Year of fee payment: 4

MAFP Maintenance fee payment

Free format text: PAYMENT OF MAINTENANCE FEE, 8TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1552); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

Year of fee payment: 8